File System Filter Driver for Malware Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware protection methods are inefficient and labor-intensive, relying on pattern matching and requiring frequent updates of malware descriptions, which leaves systems vulnerable during the update period and is prone to performance degradation and false positives.
Innovation Solution
A file system filter module operating within the operating system kernel that prevents storage of executable data formats, blocking malware propagation by intercepting and blocking write access to new files with predefined executable extensions, thereby thwarting malware at its propagation phase without the need for continuous updates or pattern scanning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pattern matching and malware description updates are used for protection, then malware recognition capability is improved, but system performance deteriorates and protection effectiveness is reduced during update periods
Solution Approach 1:
The patent applies preliminary action by blocking executable files at the file system level before they can be executed, rather than waiting for pattern matching to detect them. The filter driver preemptively prevents storage of executables with known extensions, eliminating the need for continuous pattern scanning and update cycles, thus maintaining both high reliability and system performance.
2Reliability
If malware descriptions are updated frequently to recognize new threats, then protection effectiveness is improved, but labor and cost intensity increase
Solution Approach 1:
The patent implements self-service by using the operating system's own file system filter driver mechanism to automatically block executables based on their extensions. This eliminates the need for external maintenance of malware description databases, as the system self-regulates through the filter driver that operates independently of update cycles, reducing both labor and cost intensity while maintaining effectiveness.
3Measurement precision
If pattern matching analysis is performed on data, then malware detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent applies the extraction principle by removing the time-consuming pattern matching analysis step entirely. Instead of scanning file contents for malware patterns, the system extracts and blocks files based solely on their executable extensions at the file system level. This eliminates processing time while maintaining detection accuracy for the targeted threat category.
4Reliability
If conventional virus filters and firewalls are used, then malware protection is provided, but false positives occur and system performance is reduced
Solution Approach 1:
The patent applies local quality by implementing protection specifically for executable files with known extensions, rather than applying broad pattern matching to all files. This targeted approach blocks only the specific threat category (executables) while allowing other file types to pass through unaffected, eliminating false positives for legitimate files while maintaining protection effectiveness.
Data Source
AI summary
A method is provided of protecting a computer against malware affection. The computer has a data storage and an operating system for managing the data storage. The method comprises providing a filter module in the operating system which operates to detect an attempt to store data in the data storage, to determine a data format of the data to be stored in the data storage, and to prevent storage of the data if the data format is determined to relate to a predefined type. The filter module may be provided as a file system filter driver in a kernel of the operating system. The filter module may be arranged to operate between an input/output manager of the operating system and a driver associated with the data storage. The input/output manager and driver associated with the data storage may form part of the kernel of the operating system.