Kernel-Mode I/O Filter for Malware Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures are inadequate in preventing malicious malware, such as spyware and ransomware, as they often rely on threat detection and remediation after the malware has infiltrated the system, allowing malicious processes to complete I/O operations before being neutralized.
Innovation Solution
Implementing a kernel-mode filtering process that determines and correlates queued processes with predefined policies to block or permit I/O operations, examining properties of files, processes, and actions to intercept and prevent malicious activities before they occur.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If threat detection and remediation are implemented after malware infiltration, then malware can be neutralized, but malicious processes complete I/O operations causing damage before neutralization occurs
Solution Approach 1:
The patent implements preliminary action by establishing a kernel-mode I/O filter that proactively monitors and blocks malicious I/O operations before they can cause damage. The filter intercepts I/O requests at the kernel level, correlates them with process information and policy definitions, and prevents malicious actions before completion, rather than detecting and responding after malware has already infiltrated and executed harmful operations.
Solution Approach 2:
The patent applies preliminary anti-action by pre-defining policy definitions that specify permitted and prohibited I/O operations, processes, and files. The kernel-mode filter uses these pre-established policies to automatically block malicious I/O operations before they can execute, taking counter-measures in advance rather than reacting after damage occurs.
2Reliability
If kernel-mode filtering is implemented to block malicious processes, then I/O operations can be prevented before completion, but system complexity increases
Solution Approach 1:
The patent uses an intermediary approach by introducing a kernel-mode I/O filter as a mediator layer between processes and the I/O subsystem. This filter driver intercepts I/O requests, correlates them with process information and policy definitions, and makes blocking decisions without requiring complex changes to the underlying operating system or application logic. The filter acts as a specialized intermediary component that handles the complexity of security policy enforcement.
Solution Approach 2:
The patent applies segmentation by dividing the security filtering functionality into distinct, modular components: the kernel-mode I/O filter driver, policy definition structures, process information correlation mechanisms, and blocking decision logic. This modular architecture allows each component to be developed, maintained, and updated independently, reducing overall system complexity while maintaining effective security enforcement.
Data Source
AI summary
A method and a system for filtering process I/O operations are provided herein. The system may include: a memory component configured to store computer implementable instructions; and, a processor configured to implement the computer implementable instructions, such that the system is arranged to: determine that a process is queued for initiation on the system; correlate the process with one or more predefined policies; and filter the process by blocking or permitting the process from completing I.O operations on the system according to the one or more predefined policies, wherein the computer implementable instructions are implemented in a kernel-mode of the system.