Rootkit Scanning via Hook Traversal and Signature Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security systems face limitations in detecting and removing rootkits due to heuristic and signature-based detection techniques, which are inefficient and lack precise classification and cleaning capabilities.
Innovation Solution
A rootkit scanning and removal system that traverses hooks to identify and scan code for rootkits, allowing for appropriate cleaning actions, including signature scanning and restoration of hooks to remove malicious code without rebooting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If heuristic detection techniques are used to detect rootkits by detecting suspicious behavior, then detection capability is provided, but the ability to classify rootkits precisely and provide cleaning capabilities is lost
Solution Approach 1:
The patent segments the detection process into multiple stages: initial heuristic detection to identify suspicious behavior, followed by hook traversal to locate specific rootkit code, and finally signature-based detection to precisely classify the rootkit family. This segmentation allows the system to maintain broad detection capability while achieving precise classification through progressive refinement.
Solution Approach 2:
The patent introduces hook traversal as an intermediary mechanism between heuristic detection and signature-based detection. The hooks serve as mediators that translate suspicious behavior detection into specific code location identification, enabling the system to bridge the gap between behavioral detection and precise classification.
2Measurement precision
If signature based techniques are used to detect rootkits, then detection of specific rootkit families is enabled, but the ability to identify specific areas of memory for scanning is lost, resulting in inefficient and costly detection
Solution Approach 1:
The patent performs preliminary hook traversal to identify specific areas of memory containing rootkit code before applying signature-based detection. This preliminary action narrows down the scanning scope to only the relevant memory regions, making signature-based detection more efficient rather than scanning entire memory spaces.
Solution Approach 2:
The patent applies signature-based detection locally to specific memory areas identified through hook traversal, rather than applying it globally to all memory. This local application of signature detection maintains high precision for rootkit family identification while significantly improving detection efficiency by limiting the search scope.
3Reliability
If traditional signature based techniques scan entire memory spaces, then comprehensive rootkit detection is achieved, but the process becomes costly and inefficient
Solution Approach 1:
The patent segments the memory space into relevant and irrelevant regions based on hook traversal results. Only the relevant segments identified through hook analysis are subjected to signature-based scanning, while irrelevant segments are excluded from intensive scanning. This segmentation maintains comprehensive detection coverage for rootkit-prone areas while reducing overall detection costs.
Solution Approach 2:
The patent applies partial action by performing signature-based detection only on the portion of memory that is relevant to rootkit operations, as identified through hook traversal. Rather than exhaustively scanning all memory, the system focuses computational resources on the partial set of memory regions that are most likely to contain rootkits, reducing energy consumption while maintaining detection effectiveness.
Data Source
AI summary
A rootkit scanning system, method, and computer program product are provided. In use, at least one hook is traversed. Further, code is identified based on the traversal of the at least one hook. In addition, the code is scanned for at least one rootkit.