Kernel Measurement Tool for Unauthorized Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems face vulnerabilities from cyber-attacks that target the operating system kernel and memory stack, making it difficult for traditional monitoring tools to detect malicious code, especially when it mimics legitimate software updates or disables existing monitoring tools.
Innovation Solution
A measurement tool records initial and subsequent measurements of the kernel and memory stack processes, comparing them to detect changes and triggering a monitoring tool if a threshold is exceeded, allowing for real-time detection and prevention of unauthorized modifications or malware execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional monitoring tools are used to detect malicious code, then system monitoring is maintained, but detection capability deteriorates when malware mimics legitimate software updates or disables monitoring tools
Solution Approach 1:
The system performs preliminary measurements of the kernel and memory stack at initialization time, establishing a baseline state before any potential malware execution. This allows subsequent changes to be detected even when malware attempts to disguise itself as legitimate updates or disable monitoring tools, since the original state is preserved and compared against all future measurements.
Solution Approach 2:
The system continuously compares current measurements of the kernel and memory stack against the initial baseline measurements, creating a feedback loop that detects changes. When changes exceed a threshold, the system triggers alerts and can halt execution, providing real-time detection capability that adapts to evolving malware tactics.
2Speed
If real-time monitoring is implemented to detect unauthorized code modification, then detection speed is improved, but system complexity increases
Solution Approach 1:
The system extracts and measures only the critical components - the kernel and memory stack - rather than monitoring the entire system state. This selective measurement approach enables real-time detection of unauthorized code modification while keeping the monitoring system complexity manageable by focusing resources on the most vulnerable and indicative areas.
Solution Approach 2:
The system creates a baseline copy of the kernel and memory stack state at initialization, then compares subsequent measurements against this copy. This copying approach allows efficient change detection without requiring complex analysis of every system operation, as the comparison is performed against a static reference state.
Data Source
AI summary
A method of detecting unauthorized code modification within a kernel of a computer system comprising performing a first measurement of the kernel in a kernel location, by a measurement tool executing on the computer system and storing the first measurement in a storage location. Initiating the measurement tool in response to a trigger event to perform a second measurement of the kernel. Comparing the second measurement, of the kernel, to a first measurement, of the kernel, by the measurement tool to determine a comparison value. Initiating a monitoring tool, executing on the computer system, in response to the comparison value exceeding a threshold value.