Driver Activity Interception for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus technologies are ineffective in detecting malware that operates simultaneously in both kernel and user modes using legitimate components, particularly drivers, which complicates the detection and removal of harmful files.
Innovation Solution
A system and method that intercepts API requests from drivers to applications, analyzes driver activity, and uses a danger coefficient to determine if a driver is harmful, searching for linked files and quarantining them if they exceed a threshold, utilizing a database of known dangerous drivers and virtual environment simulations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software blocks or removes legitimate drivers to detect malware, then detection capability is improved, but computer functionality deteriorates and data loss occurs
Solution Approach 1:
The patent segments the detection process into two distinct modes: kernel mode detection for driver-level threats and user mode detection for application-level threats. This segmentation allows the system to target only the specific layer where malware is present, avoiding unnecessary blocking or removal of legitimate drivers in other layers, thus maintaining computer functionality while improving detection capability.
Solution Approach 2:
The patent introduces an intermediary analysis layer that combines results from both kernel mode and user mode detections. This intermediary layer acts as a mediator that correlates findings from both modes, enabling the system to confidently identify malware that operates across both layers without falsely flagging or blocking legitimate drivers, thereby resolving the contradiction between detection reliability and system operability.
2Device complexity
If antivirus software monitors only kernel mode or only user mode, then system complexity is reduced, but detection accuracy deteriorates when malware operates in both modes
Solution Approach 1:
The patent merges the detection capabilities of both kernel mode and user mode monitoring into a unified detection system. By combining the results from both modes and analyzing them together, the system achieves high detection accuracy for malware that operates in both modes, while managing complexity through integrated architecture rather than separate independent systems.
Solution Approach 2:
The patent creates a universal detection framework that can operate in both kernel mode and user mode, with a single system capable of performing multiple detection functions. This multi-functional approach allows the same detection mechanism to work across different operational modes, reducing overall system complexity while maintaining high detection accuracy for multi-mode malware.
3Stability of the object's composition
If antivirus software allows legitimate drivers to operate unchecked, then system stability is maintained, but detection of malware using legitimate drivers deteriorates
Solution Approach 1:
The patent applies preliminary anti-action by proactively monitoring driver behavior and application interactions before malware can cause harm. The system establishes baseline behavior patterns for legitimate drivers and applications, then detects deviations from these patterns. This preliminary monitoring allows the system to identify and block malicious activity while allowing legitimate drivers to continue operating normally, thus maintaining system stability while improving detection reliability.
Data Source
AI summary
A method for detecting a harmful file includes detecting activity of a driver in an operating system by intercepting an Application Programming Interface (API) request from the driver to an application. The detected activity of the driver is analyzed to determine if the driver is dangerous. A search for a file that is linked to the application and that uses the driver is performed, in response to determining that the driver is dangerous. The file found by the search is declared to be harmful.