Kernel-Mode Process Monitoring for File Exfiltration Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively identify and track malicious processes on endpoint devices, making it difficult to detect and analyze potential threats and their actions, especially when they manipulate file operations or network transmissions.
Innovation Solution
A kernel-mode driver is used to monitor and track software processes on endpoint devices, storing identification information and performing actions such as preventing file deletion, analyzing event journal records, and transmitting cryptographic hashes to a server, to identify and manage suspicious processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a kernel-mode driver is used to monitor and track software processes, then the ability to detect suspicious processes is improved, but the device complexity increases
Solution Approach 1:
A kernel-mode driver acts as an intermediary component between the operating system kernel and user-space processes. The driver intercepts file operations and network transmissions at the kernel level, enabling sophisticated threat detection without requiring complete system reconstruction. This intermediary approach allows deep inspection of process behavior while maintaining system operational integrity.
Solution Approach 2:
The monitoring system is segmented into distinct functional modules: a kernel-mode driver for low-level interception, a user-space analysis component for event processing, and a separate component for cryptographic hash verification. This segmentation allows each module to specialize in specific tasks, improving detection capability while managing overall system complexity through modular architecture.
2Measurement precision
If real-time monitoring of file operations and network transmissions is implemented, then measurement precision of process behavior is improved, but use of energy increases
Solution Approach 1:
The system implements partial monitoring by focusing on specific high-risk operations such as file transmissions over networks and cryptographic hash comparisons. Rather than monitoring all process activities equally, the kernel driver selectively intercepts and analyzes operations that are most indicative of malicious behavior, achieving high measurement precision for critical events while reducing overall energy consumption.
Solution Approach 2:
The system performs preliminary actions by pre-computing and storing cryptographic hashes of files in a database before transmission occurs. When a file operation is detected, the system quickly compares the file's hash against the pre-stored values to identify suspicious activities. This preliminary preparation enables rapid detection without requiring intensive real-time computation during the actual monitoring process.
3Reliability
If cryptographic hash transmission to server is performed, then reliability of threat verification is improved, but loss of time in communication increases
Solution Approach 1:
Cryptographic hashes of files are pre-computed and stored in a local database before any transmission or analysis is needed. When suspicious activity is detected, the system immediately compares the file's hash against the pre-stored reference hashes locally, enabling rapid verification without waiting for server communication. This preliminary action ensures high reliability while minimizing communication delays.
Solution Approach 2:
The system performs self-verification by maintaining local copies of cryptographic hashes and independently comparing file integrity without requiring constant server validation. The kernel driver and user-space component work together to autonomously detect and verify suspicious processes using locally stored reference data, reducing dependency on external server responses and minimizing communication-related time loss.
Data Source
AI summary
A computer-implemented method includes identifying one or more software processes that execute on the endpoint device and that perform at least one file operation including opening a file, reading the file, writing the file, or transmitting the file over a network. The method further includes storing for each software process of the one or more software processes identification information about the file. The method further includes responsive to determining that a triggering event has occurred, performing one or more actions including: preventing deletion of the file, determining one or more attributes of a suspicious process that accessed the file, requesting that a separate component analyze event journal records in relation to a time interval that overlaps with when the suspicious process accessed the file, or transmitting a cryptographic hash of the file to a server.