Kernel Filter Driver for Suspended Process Injection Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current security measures fail to detect malicious processes inserted into trusted software during the suspended mode, allowing attacks to go undetected until post-factum digital forensic analysis, necessitating a real-time detection method to verify software trustworthiness.

Innovation Solution

A system and method utilizing a kernel-mode filter driver to monitor suspended processes, inject a dynamic link library (DLL) to track commands, and analyze file inputs and outputs for anomalies, determining the presence of malicious processes before allowing resumption, thereby preventing unauthorized code execution.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of energy

If the OS places applications in suspended mode to conserve RAM, then memory efficiency is improved, but security is worsened because malicious processes can be inserted undetected

Engineering Contradiction:

ImproveRAM efficiencyVSAvoidsoftware trustworthiness

Core Design Contradiction:

Loss of energyVSReliability

Solution Approach 1:

The filter driver performs preliminary actions by monitoring file inputs and outputs while the process is in suspended mode, and by injecting a DLL to hook APIs before the process resumes. This allows the system to detect malicious process insertions before they can execute, thereby maintaining security while preserving the memory efficiency benefits of suspended mode.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A filter driver is introduced as an intermediary component between the OS and the suspended process. The filter driver monitors file operations and process state changes, acting as a security checkpoint that verifies process integrity without interfering with the memory management benefits of suspended mode. This intermediary enables security verification while maintaining RAM efficiency.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If traditional security measures are used, then system performance is maintained, but detection capability is worsened because malicious insertions go undetected until post-factum analysis

Engineering Contradiction:

Improvesystem performanceVSAvoidmalicious process detection

Core Design Contradiction:

ProductivityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent replaces traditional post-factum digital forensic analysis with a real-time monitoring system using a filter driver. This substitution enables continuous detection of malicious process insertions during suspended mode, transforming security from a reactive to a proactive mechanism while maintaining system performance through efficient kernel-mode operation.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The filter driver implements feedback by continuously monitoring file inputs and outputs of suspended processes and immediately detecting anomalies. When a malicious insertion is detected, the system can respond in real-time by blocking process resumption, creating a closed-loop security system that provides immediate feedback rather than relying on post-factum analysis.

Inventive Principle:

Principle #23Feedback

3Difficulty of detecting and measuring

If a filter driver is injected to monitor suspended processes, then detection capability is improved, but device complexity is worsened

Engineering Contradiction:

Improvemalicious process detectionVSAvoidsystem structure

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The filter driver is designed to perform multiple functions: monitoring file inputs and outputs, detecting process suspensions and resumptions, analyzing process integrity, and blocking malicious resumption. By consolidating these security functions into a single multi-functional component, the patent improves detection capability while minimizing the increase in system complexity compared to multiple separate security mechanisms.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11874920B2Systems and methods for preventing injections of malicious processes in software

Publication Date: 2024.01.16 ACRONIS INT

AI summary

Disclosed herein are systems and methods for preventing malicious injections. In one aspect, a method includes monitoring active processes that are running in suspended mode. For each active process being monitored, the method includes injecting a dynamic link library (DLL) into the active process to hook an application programming interface (API) of an application corresponding to the active process, wherein the DLL is injected for tracking commands for suspension and resumption of the active process. The method includes monitoring file inputs and outputs of the application for anomalies while the active process is in the suspended mode, and when a command for resuming the active process is detected using the DLL, determining, based on the monitoring, whether a malicious process is inserted into the active process. The method includes allowing the suspended process to resume execution in response to determining that no malicious process is inserted in the active process.