Kernel Mode Driver Self-Defense for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection techniques are ineffective in identifying significantly modified or obfuscated malware, particularly in zero-day attacks, and can be thwarted by anti-emulation tricks, posing a challenge in protecting critical system resources from malicious software.
Innovation Solution
A system and method that employs a kernel mode driver and self-defense service to intercept and classify requests from untrusted applications, using machine learning models and custom rules to determine malicious behavior, thereby controlling access to protected program data and preventing unauthorized modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis techniques are used to scan software code, then known malware can be detected, but significantly modified or obfuscated malware (zero-day attacks) cannot be identified
Solution Approach 1:
The system performs preliminary classification of applications as trusted or untrusted before allowing execution. A kernel mode driver intercepts creation requests for new processes and blocks them preemptively if classified as untrusted, preventing malware from even starting to execute its malicious payload. This preliminary action occurs before the malware can modify system files or perform harmful operations.
Solution Approach 2:
A kernel mode driver acts as an intermediary layer between applications and system resources. The driver intercepts API calls and process creation requests, serving as a mediator that can inspect and block malicious activity before it reaches the target system files or resources. This intermediary provides an additional layer of protection that operates independently of static malware signatures.
2Object-affected harmful factors
If dynamic analysis techniques are used in a virtual environment, then suspicious code can be executed safely, but anti-emulation tricks cause the emulator to fail
Solution Approach 1:
The system implements self-defense mechanisms where trusted applications are granted automatic permission to perform actions that would otherwise be blocked. The kernel mode driver maintains a whitelist of trusted applications, and processes from these applications are automatically allowed without requiring classification or triggering additional security checks. This self-service approach eliminates the need for complex virtualization or emulation.
3Reliability
If kernel mode driver intercepts all requests from untrusted applications, then protected data is secured, but legitimate applications may be blocked
Solution Approach 1:
The system performs preliminary classification of applications during process creation, before any resource access occurs. By classifying applications as trusted or untrusted at the moment of process creation, the system establishes permissions in advance. Trusted applications are granted broad access rights, while untrusted applications are restricted, eliminating the need for continuous interception and classification of individual API calls.
Solution Approach 2:
The system segments applications into distinct categories (trusted and untrusted) based on their classification. This segmentation allows the kernel mode driver to apply different security policies to different groups of applications. Trusted applications form one segment with elevated privileges, while untrusted applications form another segment with restricted access, enabling fine-grained control over system resource protection.
Data Source
AI summary
Described herein are systems and methods for controlling access to a protected resource based on various criteria. In one exemplary aspect, a method comprises designating a plurality of program data installed on a computing system as protected program data; intercepting, by a kernel mode driver, a request from an untrusted application executing on the computing system to alter at least one of the protected program data; classifying, by a self-defense service, the untrusted application as a malicious application based on the intercepted request and information related to the untrusted application; and responsive to classifying the untrusted application as a malicious application, denying, by the kernel mode driver, access to the at least one of the protected program data.