Kernel API Interception for Keylogger Detection and Termination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current keylogger blockers, both signature-based and behavior-based, face challenges in effectively preventing keyloggers from recording keystrokes and mouse actions, as they require constant maintenance and fail to restrict keyloggers from establishing hooks in the hook chain, leading to potential system stalls and lack of real-time user notification.
Innovation Solution
The method involves intercepting kernel API calls to determine if a process is malicious, terminating it if necessary, and optionally prompting the user for authorization, while also monitoring input device API calls for suspicious trends and kernel device driver activities to prevent unauthorized modifications or deletions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based keylogger blockers are used, then known keyloggers can be detected, but constant maintenance and updating are required
Solution Approach 1:
The system performs self-updating by automatically obtaining updated signature databases from remote servers, eliminating the need for manual maintenance and updates by users. The keylogger blocker automatically checks for and installs updated signatures, making the maintenance process self-service oriented.
2Reliability
If behavior-based keylogger blockers are used, then unknown keyloggers can be restricted, but system stability may be compromised
Solution Approach 1:
The system introduces a trusted intermediary component that mediates between the behavior-based detection mechanisms and the system kernel. This intermediary validates detection results and coordinates with user authorization, preventing false positives from causing system instability while maintaining effective detection of unknown keyloggers.
3Object-generated harmful factors
If keyloggers are allowed to establish hooks in the hook chain, then they can record keystrokes, but system performance deteriorates due to potential stalls
Solution Approach 1:
The system performs preliminary actions by intercepting and analyzing API calls before keyloggers can establish their hooks in the hook chain. By detecting and blocking keylogger processes early in their execution, the system prevents them from recording keystrokes and avoids the performance deterioration that would result from allowing multiple hooks to accumulate in the chain.
4Loss of information
If user activity recording is not restricted, then complete monitoring is achieved, but user privacy is compromised
Solution Approach 1:
The system implements feedback mechanisms by notifying users when keylogger processes are detected and blocked. This feedback loop maintains transparency, allowing users to understand what monitoring is occurring and what protective actions are being taken, thereby balancing monitoring completeness with user privacy awareness and control.
Data Source
AI summary
A method/system for restricting recordal of user activity in a processing system. In one form, the method comprises intercepting a kernel API call of the processing system 100, determining if a process initiating the kernel API call is malicious, and in response to a positive determination, terminating the determined process. A table can be updated with request information of the process and it can be determined if a trend of requests exists for the status of the input device, and in response to a positive determination of a trend, the process may be terminated.