Direct Drive Access for Hidden Pestware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-pestware software fails to detect and remove hidden pestware files that have hooked operating system APIs, making them undetectable.
Innovation Solution
A method and system utilizing direct drive access to detect files on a storage device, flagging undetectable files as potential hidden pestware, confirming through automated signature scans, and removing them using direct drive access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-pestware software uses standard file API function calls to detect files, then the software operates with simple detection mechanisms, but hidden pestware files that hook API functions remain undetectable
Solution Approach 1:
The patent introduces a specialized detection module that acts as an intermediary between the operating system and the files to be scanned. This module bypasses the hooked API functions by directly accessing file system data structures and using alternative detection methods that do not rely on the compromised API layer, thereby detecting hidden pestware files that conventional software misses
Solution Approach 2:
The detection process is segmented into multiple independent stages: initial file system scanning to identify candidate files, secondary verification using alternative API calls or direct memory access to confirm hidden status, and final pestware analysis. This segmentation allows the system to use simple methods for most files while applying complex detection only where needed
2Reliability
If direct drive access is used to detect hidden pestware files, then detection reliability improves, but the complexity of the detection system increases
Solution Approach 1:
The system performs preliminary scanning using standard API calls to identify files that appear normal. Only files that pass through this preliminary filter or are flagged by the file system scanner are subjected to direct drive access and complex analysis, reducing the overall system complexity while maintaining high detection reliability for hidden threats
Solution Approach 2:
The detection system changes parameters such as access methods (from standard API to direct drive access), scanning depth, and verification criteria based on file characteristics and risk indicators. This adaptive parameter adjustment allows the system to use simpler methods for low-risk files and more complex methods only when necessary
Data Source
AI summary
A method and system for detecting and removing a hidden pestware file is described. One illustrative embodiment detects, using direct drive access, a file on a computer storage device; determines whether the file is also detectable by the operating system by attempting to access the file using a standard file Application-Program-Interface (API) function call of the operating system; identifies the file as a potential hidden pestware file, when the file is undetectable by the operating system; confirms through an automated pestware-signature scan of the potential hidden pestware file that the potential hidden pestware file is a hidden pestware file; and removes automatically, using direct drive access, the hidden pestware file from the storage device.