Rootkit Detection via Concurrent Platform Directory Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting rootkits are inadequate, as new rootkits can evade detection by stealth techniques, making it difficult to identify and remove them, especially those that manipulate file systems and directories, posing a risk to user data and security.
Innovation Solution
A security module compares directory listings and file tables from a control platform and a target platform running concurrently on a computing device to detect discrepancies, determining if the target platform is infected with a rootkit, and subsequently removing it or performing appropriate security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional volume mapping technology is used to detect rootkits, then detection capability is improved, but advanced rootkits can still evade detection by stealing the volume
Solution Approach 1:
The patent introduces a virtualization layer as an intermediary between the rootkit and the file system. The virtual file system driver intercepts and monitors file system operations, allowing detection of rootkit activities without exposing the rootkit to the actual file system structures. This mediator approach enables detection of stealth techniques while maintaining system stability.
Solution Approach 2:
The patent transitions from traditional single-platform detection to a multi-dimensional approach by running both control and target platforms concurrently in virtualized environments. This allows comparison of file system states from different perspectives (host vs. guest OS), revealing discrepancies that indicate rootkit presence that would be invisible in a single-platform view.
2Measurement precision
If control platform and target platform are run concurrently to compare directory listings, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The virtualization platform performs multiple functions simultaneously: it hosts both control and target platforms, manages resource allocation between them, provides the monitoring interface, and enables the comparison mechanism. This multi-functional approach reduces overall system complexity compared to implementing separate systems for each function.
Solution Approach 2:
The patent creates a virtual copy of the target platform's file system view within the control platform environment. By copying the necessary file system interfaces and data structures into the virtualized control environment, the system can compare directory listings without requiring direct access to the physical file system, simplifying the comparison mechanism.
Data Source
AI summary
A computer-implemented method for detecting rootkits. The method may include identifying, from a control platform, a first directory listing. The first directory listing may be associated with a file system. The method may include identifying, from a target platform, a second directory listing. The second directory listing may be associated with the file system. The target platform and the control platform may be running concurrently on a computing device. The method may also include detecting a discrepancy between the first directory listing and the second directory listing and determining that the discrepancy is a result of the target platform being infected with a rootkit. Various other methods, systems, and computer-readable media are also disclosed.