External Bootable Rootkit Detection Tool
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current rootkit detection methods are inadequate as they rely on analyzing the infected operating system, making it difficult to detect kernel hooks alone, and malicious hackers can evade detection by integrating rootkits into the operating system, making it challenging to identify and remediate rootkit infections effectively.
Innovation Solution
An external rootkit detection tool using a bootable USB key with rootkit detection and remediation logic that boots a target computing platform independently of the infected OS, performing scans and remediation without loading the infected OS, utilizing techniques like MD5 hashing, hidden file detection, and backdoor shell checking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If rootkit detection software analyzes the infected operating system during execution, then it can identify kernel hooks and system service modifications, but it cannot effectively detect rootkits that have integrated themselves into the operating system kernel
Solution Approach 1:
The patent applies preliminary action by performing rootkit detection during the boot process before the operating system is fully loaded and executed. The detection tool is embedded in the boot image, allowing it to scan the operating system kernel and system files in their original state, before rootkits can intercept or modify system services. This timing advantage enables the detection of rootkits that would otherwise be undetectable during normal system operation.
2Object-affected harmful factors
If rootkits are integrated into the operating system kernel, then they become nearly impossible to detect while the operating system executes, but this integration increases the complexity of rootkit structure and installation
Solution Approach 1:
The patent applies the extraction principle by removing the detection tool from the infected operating system environment and placing it in an external bootable medium. This externalization allows the detection tool to operate independently of the rootkit-infected system, accessing and analyzing kernel files and system structures without being subject to rootkit interference. The detection logic is extracted from the running OS and executed from a clean environment during boot.
3Measurement precision
If contemporary detection software uses kernel hooks to monitor system services, then it can detect modified system calls, but the presence of kernel hooks alone is not sufficient to identify malware and provides circumvention challenges for hackers
Solution Approach 1:
The patent applies inversion by reversing the traditional detection approach. Instead of installing detection hooks within the operating system kernel (which can be circumvented), the detection tool is placed in the boot image and executes before the kernel is fully loaded. This inverted timing and location strategy allows the detection tool to examine kernel structures and system files before rootkits can establish their own hooks or modifications, fundamentally changing the detection paradigm from internal monitoring to external pre-boot analysis.
Data Source
AI summary
Embodiments of the present invention address deficiencies of the art in respect to rootkit detection and provide a method, system and computer program product for external rootkit detection and remediation. In one embodiment of the invention, an external rootkit detection tool can be provided. The tool can include external static memory with an input/output (I/O) port interface to an external I/O port on a target computing platform. The tool further can include a boot image disposed in the external static memory, and rootkit detection and remediation logic disposed in the external static memory and referenced by the boot image. In one aspect of the embodiment, the external static memory can include a universal serial bus (USB) key and, correspondingly, the I/O port can include an external USB port.