File System Filter Driver for P2P Worm Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Peer-to-peer (P2P) file sharing networks provide avenues for the introduction and propagation of malicious code, such as computer worms, due to the sharing of files across systems, which existing technologies fail to effectively detect and prevent.
Innovation Solution
Intercepting calls to file system functions, such as copying or closing files, to determine if malicious code is being replicated or propagated, and taking protective actions like terminating the call or generating notifications when malicious activity is detected, particularly focusing on shared P2P file folders.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If file sharing is enabled on P2P networks, then resource exchange capability is improved, but security against malicious code propagation deteriorates
Solution Approach 1:
The patent implements preliminary detection of file copy operations before they complete. By intercepting and analyzing file system function calls (such as CopyFile, ReadFile, WriteFile) before the actual file replication occurs, the system can identify and block malicious code propagation attempts in advance, preventing worms from replicating themselves across the P2P network while still allowing legitimate file sharing to proceed.
Solution Approach 2:
The patent introduces a file system filter driver as an intermediary layer between applications and the underlying file system. This filter driver intercepts file system function calls, analyzes them for malicious behavior patterns, and decides whether to allow or block the operations. The intermediary maintains the balance between enabling file sharing and preventing malicious code propagation by selectively filtering operations based on detected threat patterns.
2Measurement precision
If file system function calls are monitored, then detection precision of malicious code is improved, but system operation speed deteriorates
Solution Approach 1:
The patent applies partial monitoring by focusing detection efforts on specific file system function calls that are most indicative of worm behavior (such as CopyFile, ReadFile, WriteFile, CreateFile). Rather than monitoring all system operations, the filter driver selectively intercepts and analyzes only those file system calls that are commonly used by worms for replication, thereby maintaining detection precision while minimizing the performance overhead associated with comprehensive monitoring.
3Reliability
If real-time detection of malicious code is implemented, then protection effectiveness is improved, but computational resource consumption increases
Solution Approach 1:
The patent implements preliminary analysis of file system function calls to identify patterns characteristic of worm behavior before actual file replication occurs. By detecting and blocking malicious operations at the file system call level rather than waiting for full file execution or replication, the system achieves effective protection with lower computational overhead, as the analysis is performed on small function call parameters rather than large file contents.
Solution Approach 2:
The patent enables rapid processing of file system function calls by the filter driver, allowing legitimate operations to pass through quickly with minimal inspection while dedicating more thorough analysis only to calls that exhibit suspicious patterns. This selective processing approach maintains protection effectiveness by quickly identifying and blocking worm behavior while allowing normal file sharing operations to proceed with minimal computational overhead.
Data Source
AI summary
A call to a file system function is intercepted in the context of a caller, and stalled. A determination is made whether malicious code, such as a peer-to peer (P2P) computer worm, is detected based upon the call. Upon a determination that malicious code is detected, protective action is taken, such as terminating the call to the file system function, and, optionally, a notification generated. Alternatively, upon a determination that malicious code is not detected, the call to the file system function is released.