Kernel Driver Malware Detection via Boot Monitor and Reputation System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Kernel mode malware is difficult to detect and repair, as anti-virus engines often lack sufficient information about device drivers, and once loaded, device driver malware can disable anti-virus functionality, making post-infection repair challenging without a system reboot.
Innovation Solution
A system and method that involves a monitor and a reputation system to identify and analyze device drivers, access historical data to evaluate suspicious drivers, and provide repair mechanisms, utilizing a cloud-based approach to communicate and enact repairs without requiring a system reboot.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anti-virus engine analyzes device driver information, then detection capability is improved, but the device driver can attack and disable anti-virus functionality
Solution Approach 1:
The system separates the detection function from the device driver execution environment by using a monitor in the boot process that operates independently before the driver can interfere. The reputation system is also segmented as a separate evaluation component that assesses drivers without being vulnerable to their attacks.
Solution Approach 2:
The monitor performs preliminary analysis of device drivers during the boot process, before the drivers are fully loaded and activated. This preliminary action allows the system to evaluate drivers while they are still in a vulnerable state, preventing them from disabling anti-virus functionality.
2Measurement precision
If device driver malware is detected after loading, then detection capability is improved, but repair becomes impossible without system reboot
Solution Approach 1:
The system performs detection and repair actions during the boot process, before the device driver malware can fully establish its control. The monitor identifies suspicious drivers and triggers repair mechanisms while the system is still in the early boot stage, making repair possible without requiring a complete system reboot.
Solution Approach 2:
The monitor acts as an intermediary between the boot process and the device drivers, providing a safe environment for detection and repair. The reputation system serves as another intermediary that evaluates drivers and provides guidance for repair actions, mediating between the detected malware and the repair process.
3Productivity
If device driver malware is not recognized as malware, then system operation is maintained, but continuous protection is compromised
Solution Approach 1:
The reputation system provides continuous feedback about device drivers by evaluating them against known malware signatures and behavioral patterns. This feedback mechanism ensures that drivers are continuously monitored and assessed, maintaining protection while allowing legitimate drivers to operate normally.
Solution Approach 2:
The system dynamically evaluates device drivers based on their behavior and characteristics rather than using static recognition. The reputation system can update its assessment of drivers over time, adapting to new threats while maintaining system operation. This dynamic approach allows the system to respond to changing conditions while preserving continuous protection.
Data Source
AI summary
A method for detecting malware device drivers includes the steps of identifying one or more device drivers loaded on an electronic device, analyzing the device drivers to determine suspicious device drivers, accessing information about the suspicious device drivers in a reputation system, and evaluating whether the suspicious device driver include malware. The suspicious device drivers are not recognized as not including malware. The reputation system is configured to store information about suspicious device drivers. The evaluation is based upon historical data regarding the suspicious device driver.