NDIS Packet Tagging for Protocol Deviation Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern malicious software and rootkits pose a significant threat by attempting to exfiltrate sensitive data by bypassing security features in computer systems, often by deviating from established protocols in the network driver stack to evade detection by host-based intrusion detection systems and firewalls.
Innovation Solution
The implementation of LastDefense, which uses packet tagging and monitoring hooks within the NDIS driver stack to detect deviations from the established protocol for sending data packets, thereby flagging potentially malicious traffic and preventing data exfiltration. This involves placing Direct Kernel Object Manipulation (DKOM) and function hooks to ensure that data packets follow the normal send path and are properly tagged, allowing for the identification and logging of suspicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If malicious software uses kernel code to bypass the driver stack, then data exfiltration can occur stealthily, but security detection capability deteriorates
Solution Approach 1:
The system performs preliminary actions by installing hooks at the miniport driver level before malicious software can bypass security measures. These hooks are positioned to intercept packets at the earliest possible point in the bypass path, enabling detection before exfiltration completes
Solution Approach 2:
The miniport driver acts as an intermediary component between the bypassed driver stack and the network interface card. By placing detection hooks at this intermediary layer, the system can monitor traffic that has already evaded upper-layer security controls without disrupting normal network operations
2Measurement precision
If comprehensive packet monitoring is implemented through hooks, then detection precision improves, but system complexity increases
Solution Approach 1:
Instead of implementing comprehensive monitoring throughout the entire driver stack, the system applies monitoring locally at the specific miniport driver layer where bypass traffic converges. This localized approach achieves high detection precision while minimizing the scope of modifications required
Solution Approach 2:
The hook mechanism implemented in the miniport driver serves multiple functions simultaneously: it detects protocol deviations, logs suspicious activity, and can potentially block malicious packets. This multi-functionality reduces the need for separate detection systems, thereby limiting complexity growth
3Reliability
If hooks are installed to monitor packet paths, then detection capability improves, but performance overhead increases
Solution Approach 1:
The system applies partial monitoring by focusing hooks only on critical packet attributes and only at the miniport driver layer where bypass traffic is most likely to appear. This selective monitoring approach maintains detection capability while reducing the processing overhead compared to comprehensive packet inspection
Solution Approach 2:
The hook implementation allows legitimate packets to pass through with minimal processing by using efficient comparison operations against the established protocol model. Suspicious packets are identified and processed more thoroughly, while normal traffic flows rapidly, maintaining overall system throughput
Data Source
AI summary
A determination is made as to whether an attempt to send a data packet from a computer system has deviated from an established protocol for sending data packets from the computer system is made. The determination includes obtaining a data structure describing the data packet, and, based on invocation of a function to deliver the data packet to a module of a stack of the computer system, the module interfacing network hardware for sending the data packet, checking for presence of a tag placed in the data structure by a component of the stack and indicative of whether the attempt to send the data packet has deviated from the established protocol. Processing is then performed based on the determination of whether the attempt has deviated from the established protocol.