Keylogger Detection via Test String Injection and Memory Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively detect software-based keyloggers, which are difficult to detect due to their malicious nature and ability to operate at the kernel level, often requiring large pattern files and continuous heuristic monitoring.
Innovation Solution
A computer-implemented method that generates a unique test string and simulates keyboard input to detect keyloggers by scanning files and processes for the presence of the test string, allowing for detection without relying on pattern files or continuous monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pattern-matching and heuristic algorithms are used to detect keyloggers, then detection capability is improved, but the size of the pattern file becomes very big and continuous monitoring is required
Solution Approach 1:
The system performs preliminary actions by injecting code into the keylogger process before it can capture keyboard inputs. A test string is injected into the keylogger's memory space, and then the system checks whether the keylogger process contains this test string. This preliminary injection and verification action allows detection without requiring large pattern files or continuous monitoring, as the detection occurs at a specific moment when the keylogger is active.
Solution Approach 2:
The test string acts as an intermediary element between the detection system and the keylogger. Instead of directly analyzing the keylogger's complex behavior or using large pattern files, the system introduces a simple test string as a mediator that can be reliably detected in the keylogger's memory space. This intermediary approach simplifies the detection mechanism while maintaining high reliability.
2Measurement precision
If kernel level monitoring is used to detect keyloggers, then detection accuracy is improved, but the complexity of detection and measurement increases
Solution Approach 1:
The system creates a copy of the test string in the keylogger process's memory space by injecting the string into the process. This copying approach allows the detection system to verify the presence of the test string in the keylogger's memory without directly analyzing the complex kernel-level operations or memory structures of the keylogger itself, thereby reducing detection complexity while maintaining accuracy.
Solution Approach 2:
The system changes the state of the keylogger process by injecting the test string into its memory space. This parameter change (adding the test string to memory) creates a detectable state that simplifies the detection process. Instead of monitoring complex kernel-level behavior, the system simply checks for the presence of the test string in the process memory, significantly reducing measurement complexity.
3Object-affected harmful factors
If virtual keyboard, automatic form filler, or speech recognition are used to prevent keyloggers, then prevention capability is improved, but the keylogger remains undetected
Solution Approach 1:
The system provides feedback about the keylogger's presence by injecting a test string into the keylogger process and then checking whether the process contains this string. This feedback mechanism allows the system to detect the keylogger's presence even when prevention methods like virtual keyboards or form fillers are in place. The feedback loop completes by detecting whether the test string was successfully injected and remains in the process memory.
Data Source
AI summary
Keyloggers are detected in a computer. A test string is generated in the computer. Keyboard input is simulated using the test string. The test string may be input to a hidden browser connected to a sensitive site or a hidden application program, for example. Files modified during the input procedure are detected. Processes running in memory and modified files are scanned for presence of the test string to detect keyloggers.