Filter Driver Tracking Untrusted Executables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for improved systems and methods to track content derived from unverified sources, as content from external sources, such as remote Web servers and removable storage devices, lacks trustworthiness until verified by security applications, potentially leading to untrusted content being accessed and affecting other processes during the verification period.
Innovation Solution
A filter driver on the user's computing device monitors system folders for new content and tracks untrusted files by maintaining a watchlist, identifying files and processes that access untrusted content, and blocking functionality of untrusted executable files to prevent potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If content from external sources is allowed to be accessed during verification period, then ease of operation is improved, but system security deteriorates
Solution Approach 1:
The patent introduces a filter driver as an intermediary component between untrusted content and the file system. This filter driver monitors and controls access to unverified content, allowing legitimate operations while blocking malicious ones. The filter driver acts as a mediator that enables content access during verification while maintaining security through controlled access mechanisms.
Solution Approach 2:
The system performs preliminary actions by creating a watchlist of untrusted content before verification completes. The filter driver proactively monitors and tracks content from untrusted sources in advance, establishing control measures before potential harm can occur. This preliminary tracking and monitoring enables security enforcement while allowing operational flexibility.
2Reliability
If filter driver monitors all system folders for untrusted content, then system security is improved, but device complexity increases
Solution Approach 1:
The filter driver implements local quality by applying different monitoring strategies to different system folders. Instead of uniform monitoring across all folders, the system tailors the level and type of monitoring to specific folders based on their risk profiles and importance. This selective approach maintains security while reducing unnecessary complexity in low-risk areas.
Solution Approach 2:
The monitoring system is segmented into discrete components that can independently track and manage different untrusted files. The filter driver divides the monitoring task into manageable segments, allowing the system to handle multiple untrusted files through modular tracking mechanisms rather than monolithic complex monitoring.
Data Source
AI summary
A system and method for tracking content derived from unverified sources are described. A tracking application determines a file is untrusted when it is obtained from an unverified or untrusted source. Examples of unverified sources include remote servers accessed through a network and removable storage devices. The application marks the file as untrusted by inserting an identification of the file in a watchlist. A filter driver monitors I/O transactions and conveys information regarding file operations and corresponding processes to the tracking application. The filter driver detects a trusted process touches an untrusted file. The application marks the process as being untrusted. The filter driver detects the process subsequently touches another file. The application then marks this other file as untrusted.