RootKit Detection via Library Integrity Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional antivirus software relies on signature matching and operating system services to detect malware, but malware like RootKits can infect the operating system, concealing itself and evading detection by manipulating API calls and library modifications, making it difficult to identify and prevent malicious activity.
Innovation Solution
A generic RootKit detector compares properties of library versions loaded in memory with those stored on a storage device, using an integrity module and scan engine to detect signature patterns and trace program execution paths to identify and bypass RootKit modifications, ensuring accurate detection and prevention of malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus software uses signature matching and scanning, then malware detection capability is improved, but RootKits can manipulate operating system services and library files to conceal themselves and evade detection
Solution Approach 1:
The patent applies preliminary action by comparing library properties before malware can execute. The integrity module compares properties of libraries loaded into memory with known good versions stored in a protected state, detecting RootKit modifications before they can conceal themselves from detection.
Solution Approach 2:
The patent introduces an intermediary approach by using a protected state storage mechanism that maintains known good library versions. This intermediary layer allows the integrity module to detect modifications without directly interacting with the compromised memory libraries, enabling detection while avoiding direct exposure to RootKit manipulation.
2Reliability
If antivirus software scans files before opening, then malware execution is prevented, but system performance and user productivity are reduced due to scan delays
Solution Approach 1:
The patent replaces the mechanical scanning approach with a property comparison mechanism. Instead of scanning every file before opening (which blocks execution), the integrity module compares properties of loaded libraries against known good versions in the protected state, allowing faster detection without blocking legitimate operations.
Solution Approach 2:
The patent changes the detection parameter from binary scan results to property comparison. By comparing properties (such as checksums, metadata, or structural characteristics) of libraries in memory against stored good versions, the system can detect malware without the performance penalty of pre-opening scans.
3Object-affected harmful factors
If RootKits modify library files after loading, then malware concealment is improved, but system integrity and stability are compromised
Solution Approach 1:
The patent applies preliminary action by establishing known good library versions in a protected state before RootKits can modify them. The integrity module then compares current library properties against these pre-established good versions, detecting modifications as they occur and preventing RootKit concealment.
Solution Approach 2:
The patent implements feedback by continuously comparing library properties against known good versions. When modifications are detected, the system receives feedback about the compromise state and can trigger appropriate responses, creating a closed-loop detection system that maintains system integrity.
Data Source
AI summary
A generic RootKit detector is disclosed that identifies when a malware, commonly known as RootKit, is resident on a computer. In one embodiment, the generic RootKit detector performs a method that compares the properties of different versions of a library used by the operating system to provide services to an application program. In this regard, when a library is loaded into memory, an aspect of the generic RootKit detector compares two versions of the library; a potentially infected version in memory and a second version stored in a protected state on a storage device. If certain properties of the first version of the library are different from the second version, a determination is made that a RootKit is infection the computer.