Key Logger Detection via Keystroke-Write Activity Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting key loggers in computing systems are inadequate, as antivirus software relies on signature detection with a lag in updating threat signatures, and forensic analysis is impractical for ongoing monitoring, making it difficult to detect new or disguised key logger activity.
Innovation Solution
A key logger detector that correlates the count of keystrokes within defined time windows with write activity, such as file growth or network traffic, to identify potential key logger presence by determining linear relationships over multiple windows, allowing for timely detection and notification or removal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software uses signature detection to identify key loggers, then known key loggers can be detected, but new or disguised key loggers cannot be detected timely due to lag in signature updates
Solution Approach 1:
The patent changes the detection parameter from static signature matching to dynamic behavioral analysis. It monitors keystroke timing patterns, write operation frequencies, and temporal correlations between keyboard input and file/network operations. By analyzing these temporal parameters and their correlations, the system can detect key loggers based on their operational behavior rather than relying on known signatures, enabling timely detection of new or disguised key loggers.
2Measurement precision
If forensic software is used to detect key logging activity, then key loggers can be detected in post-mortem analysis, but regular or ongoing detection is infeasible
Solution Approach 1:
The patent implements continuous monitoring of system events including keystrokes, write operations, and temporal patterns. Instead of performing discrete forensic analysis on memory dumps, the system continuously collects and analyzes behavioral data in real-time, maintaining ongoing detection capability that can identify key loggers as they operate rather than only after the fact.
3Reliability
If antivirus software monitors all system activity for key logger signatures, then detection coverage is comprehensive, but system performance degrades due to high computational overhead
Solution Approach 1:
The patent extracts and monitors only the specific events relevant to key logger detection: keystroke timestamps, write operation timestamps, and their temporal correlations. Instead of analyzing all system activity, it focuses on this subset of events that directly indicate key logging behavior, significantly reducing computational overhead while maintaining effective detection coverage.
Data Source
AI summary
Detection of a key logger includes determining a count of keystrokes that occur during each of a plurality of time windows. Write activity that occurs during each of the plurality of time windows can be measured. The number of key strokes occurring in window is compared with the write activity occurring during the window. In response to determining that the count of keystrokes in a time window is linearly related to the measurement of write activity in the time window for a threshold number of time windows of the plurality of windows, a notification of a potential presence of a key logger is provided.