Ring-Level Security Module for Hidden Process Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security software is limited in filtering malicious activities by malware operating at the same level as the operating system kernel, making it difficult to detect and prevent hidden processes, as kernel mode malware can tamper with user mode memory and deceive detection logic, compromising both the operating system and security software integrity.
Innovation Solution
A system and method that includes a first security module operating below all operating systems to trap and record attempts to access system resources, comparing these with enumerated processes visible to the operating system to identify hidden processes, thereby determining and addressing malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security software operates at the operating system kernel level, then it can filter and detect malicious activities, but malware operating at the same level can tamper with user mode memory and deceive detection logic
Solution Approach 1:
The patent introduces a new dimension by implementing a security module that operates below the operating system kernel level. This hierarchical layering creates a privileged execution ring that can monitor and trap kernel operations without being vulnerable to kernel-level malware attacks, effectively adding a vertical security dimension to the traditional horizontal security model.
Solution Approach 2:
The security module acts as an intermediary between the hardware and the operating system kernel. By positioning itself in this intermediate layer, it can intercept and monitor system calls and memory access attempts before they reach the kernel, preventing malware from tampering with detection logic while maintaining system functionality.
2Productivity
If security software filters all behaviors at the operating system level, then it can identify malicious actions, but it cannot detect hidden processes that operate below the operating system level
Solution Approach 1:
The security module performs preliminary actions by establishing trap routines and monitoring mechanisms before malware can execute its hidden processes. By pre-positioning detection hooks at the privileged execution level, the system can identify and block malicious activities before they manifest in user mode, making hidden processes visible to security software.
3Object-affected harmful factors
If kernel mode malware tamper with user mode memory to hide processes, then it can evade security software detection, but a security module operating below the kernel can trap and record these attempts
Solution Approach 1:
The security module implements a feedback mechanism by continuously monitoring memory access patterns and comparing enumerated processes against actual system state. When discrepancies are detected indicating hidden processes, the module generates security events and takes corrective actions, creating a closed-loop detection system that adapts to evolving malware techniques.
Data Source
AI summary
A security module may be configured to execute on the electronic device at a level below all of the operating systems of an electronic device accessing the one or more system resources. The security module may be configured to: trap one or more attempts to access system resources of the electronic device, the one or more attempts made from a less privileged ring of execution than the first security module; record information identifying one or more processes attempting to access the system resources of the electronic device; compare the information identifying one or more processes attempting to access the system resources with the enumerated one or more processes visible to the operating system; and based on the comparison, determine one or more hidden processes, the hidden processes determined by at least identifying processes whose information was recorded by first security module but were not enumerated by the second security module.