Dual OS Intrusion Detection via Segmented Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems in devices with multiple operating systems can be deactivated by attackers or malicious programs, leading to incomplete or total system deactivation, which prevents the detection of suspicious activities and vulnerabilities.
Innovation Solution
Implementing a failover mechanism between two operating systems, where one system collects and analyzes data from the other, ensuring continuous monitoring and detection of intrusions, even if the primary system is compromised, by using a buffer memory and a trusted operating system that executes exclusively and has access to all device resources, and employing encryption and access rights verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an intrusion detection system is implemented in a single operating system, then the system can detect suspicious activities, but the intrusion detection system can be deactivated by attackers or malicious programs
Solution Approach 1:
The device is divided into two separate operating systems: a first operating system that runs applications and a second operating system that executes the intrusion detection system. This segmentation ensures that malware in the first OS cannot directly deactivate the intrusion detection system in the second OS, as they operate in isolated environments with controlled inter-process communication.
Solution Approach 2:
An inter-process communication mechanism acts as an intermediary between the two operating systems. The first OS sends activity data to the second OS through this controlled interface, allowing the intrusion detection system to monitor suspicious activities while preventing direct access or deactivation by malicious programs in the first OS.
2Reliability
If two operating systems are implemented with failover mechanism, then continuous monitoring is ensured, but device complexity increases
Solution Approach 1:
The device is divided into two separate operating systems: a first operating system that runs applications and a second operating system that executes the intrusion detection system. This segmentation ensures that malware in the first OS cannot directly deactivate the intrusion detection system in the second OS, as they operate in isolated environments with controlled inter-process communication.
Solution Approach 2:
The second operating system serves multiple functions: it executes the intrusion detection system, analyzes collected data for suspicious activities, and maintains the failover mechanism. By consolidating these functions in a single OS, the overall system complexity is managed more effectively despite the presence of dual operating systems.
3Reliability
If data is collected and analyzed in real-time, then suspicious activities are detected promptly, but system resources are consumed
Solution Approach 1:
The data collection and analysis functions are extracted into separate modules: a collection module that gathers activity data from the first operating system and an analysis module that processes this data in the second operating system. This separation allows for optimized resource management, where data is collected continuously but analysis is performed selectively based on detected anomalies or predefined triggers.
Solution Approach 2:
Instead of continuous real-time analysis of all collected data, the system employs periodic analysis intervals triggered by specific events or time-based schedules. The analysis module processes collected data at these intervals, reducing overall computational resource consumption while maintaining effective intrusion detection capability.
Data Source
Figure 1~3
Figure 2
AI summary
The invention concerns the field of intrusion detection systems dedicated to an operating system, and more particular an intrusion detection system in a device implementing at least a first operating system and a second operating system. According to the invention, the intrusion detection systems comprises: a listening module (1110) configured to be executed in the first operating system in order to listen to the activity of this first operating system; a collecting module (1120) configured to be executed in the first operating system in order to collect data characterising the activity of the first operating system; and an analysis and detection module (1150) configured to be executed in the second operating system in order to analyse the data collected in the first operating system and detect a suspicious activity in the first operating system depending on said analysis.