Secondary Service Module Bypasses Native Hooks for Rootkit Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security measures are ineffective in detecting hidden objects, such as rootkits, which can conceal their existence by intercepting system functions and modifying responses, making it difficult to identify their presence using known antivirus techniques.
Innovation Solution
A computer system with a secondary service module that generates and returns requested information by bypassing the native service module, allowing authorized processes to access and compare the information, thereby identifying hidden objects and determining if the native service module has been compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional antivirus techniques are used to detect malware, then detection capability is maintained, but hidden objects such as rootkits cannot be effectively detected because they intercept and modify system function responses
Solution Approach 1:
The patent introduces a secondary service module as an intermediary between processes and the native service module. This mediator bypasses the compromised native service module to obtain authentic system information, enabling detection of hidden objects without being affected by rootkit intercepts
Solution Approach 2:
The patent creates a secondary service module that replicates the functionality of the native service module. By comparing outputs from both modules, the system can identify discrepancies caused by hidden objects, effectively copying the service interface to enable detection
2Reliability
If a separate detector is introduced to bypass compromised kernel code, then rootkit detection capability is improved, but the separate detector itself may be targeted and compromised by rootkit-like malware
Solution Approach 1:
Instead of having the detector bypass the kernel, the patent inverts the approach by having the secondary service module bypass the detector's access path. Authorized processes directly access the secondary service module through controlled interfaces, making the detection mechanism itself inaccessible to malware
3Reliability
If access to the secondary service module is limited through authentication protocols, then system security is improved, but access complexity increases
Solution Approach 1:
The patent applies access limiting selectively - only authorized processes need authentication to access the secondary service module, while other processes use the native service module normally. This localized application of security reduces overall system complexity while maintaining necessary protection
Data Source
Figure 1
Figure 2
Figure 3
AI summary
System and method for detecting a security compromise of a service module of an operating system running on a computer. At least one native service module returns a first set of requested information relating to at least one object in the computer system in response to a request made by at least one process or thread. A secondary service module generates and returns a second set of requested information relating to the at least one object in the computer system in response to a request made by at least one authorized process or thread, bypassing the at least one native service module. Access of threads is limited to the secondary service module such that only predetermined threads generated by a trusted security application are permitted to access the secondary service module.