Rootkit Detection via File System Filter Driver Query Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting hidden files and folders installed by rootkits are limited as they do not identify the hiding method, are not portable across operating system modifications, and are not suitable for real-time detection, often leading to errors due to reliance on undocumented file system structures and offline forensic analysis.
Innovation Solution
A method involving generating and transmitting query I/O request packets to file system driver objects to identify differences in folder listings, determining which files or folders are hidden by identifying discrepancies between results from different driver objects, thereby identifying the hiding method and enabling real-time detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If NTFS on disk structure parsing is used to detect hidden files, then detection efficiency is improved, but portability deteriorates due to undocumented structure and reliance on reverse engineering
Solution Approach 1:
The patent uses the file system filter driver as an intermediary layer between the detection tool and the file system. Instead of directly parsing NTFS on-disk structures, the detection tool queries the filter driver which in turn queries the file system. This intermediary approach provides stable, documented interfaces that work across different OS versions while maintaining high detection efficiency through direct kernel-mode access.
Solution Approach 2:
The patent replaces the mechanical approach of parsing raw on-disk NTFS structures with a software-based query mechanism through the file system filter driver interface. This substitution uses documented driver interfaces and standardized I/O request packets, eliminating the fragility of reverse-engineered structure parsing while maintaining detection capability.
2Measurement precision
If NTFS on disk structure reading is used for detection, then offline forensic analysis capability is improved, but real-time detection capability deteriorates due to cache inconsistencies
Solution Approach 1:
The file system filter driver acts as a real-time intermediary that receives queries about current file system state and returns accurate information from kernel memory. This eliminates the cache inconsistency problem because the filter driver can query the current state of the file system through documented interfaces, providing both forensic accuracy and real-time capability simultaneously.
Solution Approach 2:
The detection tool sends query I/O request packets that trigger the file system to prepare and return directory listings before comparison. This preliminary action ensures that the file system state is captured at a specific moment in time, providing consistent snapshots for both forensic analysis and real-time detection without suffering from cache timing issues.
3Loss of information
If file system filter driver queries are used to detect hidden files, then identification of hiding method is improved, but device complexity increases due to multiple driver object interactions
Solution Approach 1:
The patent segments the detection process into distinct query I/O request packets sent to different file system driver objects. Each driver object is queried independently, and their responses are compared to identify discrepancies. This segmentation makes the complex interaction manageable and systematic, allowing identification of which driver is hiding files while organizing the complexity into repeatable, modular steps.
Data Source
AI summary
A method, system, and computer program product for detecting hidden files and folders that may be installed by or as part of a rootkit provides the capability to identify the method that is used to hide the files and folders, will continue working even if the operating system is modified, and is suitable for real-time detection of hidden files and folders. A method for detecting a rootkit comprises the steps of generating a plurality of query input/output request packets, each query input/output request packet requesting information relating to a file system directory folder, transmitting a generated query input/output request packet to each file system driver object, receiving a result including the requested information relating to a file system directory folder from each file system driver object, and determining differences among each result, to determine information relating to a file system directory folder that is removed by at least one file system driver object.