Kernel Rootkit Detection via Binary-to-Image Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Kernel rootkits are difficult to detect and remove due to their ability to modify the operating system kernel and prevent common file and registry scans from detecting them, making existing antivirus technologies ineffective.
Innovation Solution
An anti-rootkit module compares operating system kernel binary files to their in-memory loaded image, performs a pre-scan to ensure paging functions and interrupt dispatch table integrity, and restores modifications to a known good condition to disable rootkits, allowing for subsequent virus scans to remove remaining malicious code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If common file and registry scans are performed to detect rootkits, then the scan process is simple and fast, but kernel rootkits can conceal themselves by patching the operating system kernel, making them undetectable
Solution Approach 1:
The system performs a pre-scan before the main scan to ensure paging functions and interrupt dispatch table are in known good condition. This preliminary action prevents rootkits from interfering with the scan process and enables subsequent detection to work effectively despite kernel modifications
Solution Approach 2:
The system creates a copy of the kernel file image in memory and compares it with the original kernel binary files. This copying approach allows detection of modifications without directly analyzing the potentially compromised running kernel, enabling rootkit detection while maintaining scan speed
2Difficulty of detecting and measuring
If behavior-monitoring is used to detect rootkits, then detection capability improves, but rootkits modify kernel API to prevent removal, making them difficult to eliminate
Solution Approach 1:
The system extracts the rootkit code from the modified kernel API by comparing memory images with original binaries. Once extracted and identified, the rootkit can be removed independently from the compromised kernel structures, enabling both detection and removal
Solution Approach 2:
The pre-scan performs preliminary preparation by ensuring paging functions and interrupt dispatch table are in known good condition before attempting removal. This prevents rootkits from interfering with the removal process and enables successful elimination
3Object-affected harmful factors
If kernel rootkits patch the operating system kernel, then they can conceal themselves from file and registry scans, but this also prevents applications from removing them by modifying kernel API
Solution Approach 1:
The system creates a copy of the kernel file image in memory and compares it with the original kernel binary files stored on disk. This copying approach allows the system to detect and identify rootkit modifications without being prevented by the modified kernel API, enabling both concealment detection and subsequent removal
Solution Approach 2:
The system uses an intermediary comparison process between the memory image and original binaries to detect rootkit modifications. This intermediary approach bypasses the need to directly call modified kernel APIs, enabling detection and removal despite kernel patching
Data Source
AI summary
In one embodiment, an anti-rootkit module compares operating system kernel binary files to their loaded kernel file image in memory to find a difference between them. The difference may be scanned for telltale signs of rootkit modification. To prevent rootkits from interfering with memory access of the kernel file image, a pre-scan may be performed to ensure that paging functions and the interrupt dispatch table are in known good condition. If the difference is due to a rootkit modification, the kernel file image may be restored to a known good condition to disable the rootkit. A subsequent virus scan may be performed to remove remaining traces of the rootkit and other malicious codes from the computer.