Cloud-Based Rootkit Detection Using Atomic Script Rules
Solution Overview
Problem
Rootkits are difficult to detect and remove due to their ability to subvert anti-virus software and interfere with detection and removal processes, leading to system instability and slow update frequencies, which is particularly problematic in autonomous vehicles and server systems.
Innovation Solution
A cloud-based system that abstracts rootkit detection and removal into atomic operations, using script-language rules transmitted from cloud servers to endpoint devices to execute specific operations for detecting and removing target rootkits, improving real-time operability and stability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anti-virus software uses high-privilege detection modules to detect rootkits, then detection capability is improved, but system stability deteriorates due to potential system crashes and Blue Screen of Death
Solution Approach 1:
The patent introduces a cloud-based intermediary system that mediates between the endpoint device and rootkit detection/removal operations. The cloud server receives endpoint data, determines appropriate script-language rules, and transmits them to the endpoint for execution. This intermediary approach allows complex rootkit detection and removal operations to be performed without directly compromising the stability of the endpoint's high-privilege modules.
Solution Approach 2:
The patent segments the rootkit detection and removal process into atomic operations that can be independently executed. By breaking down the complex detection and removal tasks into smaller, discrete script-language rules, the system can apply targeted fixes without triggering system-wide instability. Each atomic operation can be executed and validated independently, reducing the risk of catastrophic system failures.
2Measurement precision
If vendors port rootkit detection and removal code to endpoint anti-virus software, then detection accuracy is improved, but device complexity increases leading to system instability
Solution Approach 1:
The patent extracts the complex rootkit detection and removal code from the endpoint anti-virus software and relocates it to a cloud-based system. The endpoint device only needs to transmit data to the cloud and execute received script-language rules, while the cloud server handles the complex analysis and rule generation. This extraction reduces the complexity burden on endpoint devices while maintaining high detection accuracy through cloud-based processing.
3Adaptability or versatility
If rootkit detection and removal code is pushed to end users for update, then adaptability to new rootkits is improved, but update speed deteriorates due to long tail effect and restart requirements
Solution Approach 1:
The patent changes the delivery format of anti-rootkit code from binary executable files to script-language rules. Script-language rules can be interpreted and executed without requiring system restarts, and they can be updated more frequently and efficiently. The cloud server can push updated rules to endpoint devices, which then execute them immediately without the delays associated with binary code deployment and system reboots.
4Measurement precision
If separate removal tools are used for different rootkits, then detection specificity is improved, but ease of operation deteriorates requiring user expertise
Solution Approach 1:
The patent creates a universal cloud-based platform that handles multiple rootkit types through a single interface. The cloud server receives endpoint data, automatically determines the appropriate script-language rules for the detected rootkit, and manages the removal process. Users interact with a single unified system rather than needing to select and operate separate tools for different rootkits, greatly simplifying operation while maintaining the ability to handle diverse rootkit threats.
Data Source
AI summary
An exemplary method includes: obtaining, at one or more cloud servers, endpoint data of an endpoint computing device; based on the endpoint data, determining, by the one or more cloud servers, a plurality of script-language rules, wherein: each of the plurality of script-language rules corresponds to an atomic operation of detecting and/or removing at least one rootkit, the at least one rootkit comprises a target rootkit, and the plurality of script-language rules comprise a set of one or more rootkit rules corresponding to the target rootkit; and transmitting, by the one or more cloud servers to the endpoint computing device, the plurality of script-language rules, wherein the set of rootkit rules is executable at the endpoint computing device to detect and/or remove the target rootkit by, for each of the set of rootkit rules, executing a corresponding atomic operation.