Kernel Intermediary for Rootkit Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are ineffective in detecting malware that uses stealth techniques to hide its resources, making it difficult to identify and remove, especially since malware can intercept and filter system calls and provide false clean versions of files for hash code comparison.
Innovation Solution
A security system that invokes both high-level user mode and low-level kernel mode functions to create 'lie' and 'truth' lists, comparing them to detect hidden resources, and uses obfuscation techniques to prevent malware identification and infection, with the ability to rename executable files and inject code to confirm root processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If malware uses stealth techniques to intercept and filter system calls, then the malware can hide its resources and make them invisible, but this makes detection by conventional scanning tools and system utilities ineffective
Solution Approach 1:
The patent introduces a kernel-level intermediary component that acts as a mediator between user-mode applications and the filesystem. This kernel module directly queries the filesystem without going through user-mode interception points, allowing it to see hidden files that conventional user-mode tools cannot detect. The intermediary bypasses the malware's filtering mechanism by operating at a different level in the system hierarchy.
Solution Approach 2:
The patent transitions from two-dimensional detection (user-mode application layer) to three-dimensional detection by adding a kernel-mode layer. By querying the filesystem from kernel mode directly, the system gains an additional dimension of observation that penetrates through the malware's stealth layer, enabling detection of hidden resources that remain invisible to conventional user-mode scanning tools.
2Reliability
If malware provides clean versions of files for hash code comparison, then the malware can prevent detection through hash matching, but this creates false negatives in malware detection
Solution Approach 1:
The kernel-level intermediary serves as an uncorrupted mediator that directly accesses filesystem data without malware interference. By obtaining file information and hashes directly from kernel mode, the system gets authentic data that reflects the true state of files on the filesystem, preventing malware from manipulating the detection process through provided clean versions.
Solution Approach 2:
The system performs preliminary actions by directly querying the filesystem in kernel mode before the malware can manipulate or provide false versions of files. This preliminary direct access ensures that the detection process works with the actual infected state of files rather than being deceived by malware-provided clean copies.
3Productivity
If conventional scanning tools search for suspicious entries in file systems and process tables, then they can identify known malware patterns, but they cannot detect hidden resources that malware has made invisible
Solution Approach 1:
The kernel intermediary acts as a powerful mediator that directly queries the filesystem and process tables at the kernel level. This allows the scanning tool to efficiently retrieve comprehensive information about all resources including hidden ones, without having to manually search through filtered lists or rely on user-mode tools that cannot see hidden entries.
Solution Approach 2:
The kernel-mode scanning component provides universal detection capability that works across all types of resources (files, directories, processes, registry entries) regardless of whether they are hidden or visible. This single kernel-level mechanism replaces multiple specialized user-mode tools and provides comprehensive multi-functional detection in one unified approach.
Data Source
AI summary
A method and system for determining whether resources of a computer system are being hidden is provided. The security system invokes a high-level function of user mode that is intercepted and filtered by the malware to identify resources. The security system also directly invokes a low-level function of kernel mode that is not intercepted and filtered by the malware to identify resources. After invoking the high-level function and the low-level function, the security system compares the identified resources. If the low-level function identified a resource that was not identified by the high-level function, then the security system may consider the resource to be hidden.