Filesystem Minifilter Driver for Unauthorized Change Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security technologies, such as firewalls and anti-virus software, are inadequate in preventing unauthorized changes to computer data and configurations, as they can be bypassed by evolving malware and phishing attacks, and require continuous updates to detect new viruses, while also being burdensome for users with authorization requirements.
Innovation Solution
A computing system with a filesystem minifilter driver that intercepts I/O events, extracts metadata, and creates backup copies of filesystem objects, allowing for system restore operations to revert changes and prevent unauthorized modifications, thereby protecting data from malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security technologies (firewalls, anti-virus software) are used to protect data, then security protection is provided, but they can be bypassed by evolving malware and require continuous updates
Solution Approach 1:
The system creates backup copies of data files before any modifications occur, and establishes a baseline state of the file system. This preliminary action ensures that even if malware successfully bypasses traditional security measures and makes changes, the original state is already preserved and can be restored, making the security approach proactive rather than reactive
Solution Approach 2:
The patent implements a file system driver that automatically creates backup copies of data files when they are modified. These backups serve as a redundant copy that can be used to restore the original state if unauthorized changes are detected, providing security through duplication rather than through detection and blocking of malicious actions
2Reliability
If authorization requirements (passwords, physical keys) are imposed to prevent unauthorized changes, then security is improved, but user convenience deteriorates
Solution Approach 1:
The system automatically monitors file system changes, detects unauthorized modifications, and restores data without requiring user intervention. The protection mechanism operates autonomously in the background, eliminating the need for users to manually enter passwords or authenticate each action, thus maintaining security while preserving user convenience
Solution Approach 2:
The file system driver continuously monitors changes to data files and provides feedback about unauthorized modifications. When changes are detected that match patterns of malicious activity, the system automatically triggers restoration procedures, creating a closed-loop security mechanism that responds to threats without requiring user awareness or action
3Reliability
If continuous monitoring and backup of all filesystem changes is implemented, then data protection is improved, but system complexity increases
Solution Approach 1:
The patent extracts and monitors only specific types of file system changes that are indicative of malicious activity, rather than attempting to track and protect against all possible modifications. By focusing on relevant change patterns and using heuristics to identify suspicious activity, the system reduces the complexity of monitoring while maintaining effective protection
Data Source
AI summary
A computing system includes a memory device, a persistent storage device, and a processor. The persistent storage device includes a filesystem having filesystem objects and a protection system stored thereon. The protection system includes a filesystem minifilter driver and a protection service. The minifilter driver intercepts an input/output (I/O) event directed to a target filesystem object and extracts system event metadata from the I/O event. The system event metadata includes an identifier of the target filesystem object. The system event metadata is transmitted to the protection service and recorded in a record file. A backup copy of the target filesystem object created. The I/O event is released after recordation of the system event metadata and creation of the backup copy, thereby enabling the I/O event to be performed on the target filesystem object. During a system restore operation, the target filesystem object is replaced with the backup copy.