Stealth Malware Detection via Process State Inversion

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Malware, particularly those employing stealth techniques, evade detection by existing antivirus and anti-spyware software, making it difficult to determine their presence on a computer.

Innovation Solution

A method that involves obtaining two sets of data on active processes, one in a non-interrupt environment and one after interrupting program execution, and comparing them for inconsistencies indicative of malware presence, using a scanner module and an interrupt service routine to identify stealth malware.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If malware employs stealth techniques to hide its presence, then the malware's ability to evade detection is improved, but the reliability of malware detection by antivirus software deteriorates

Engineering Contradiction:

Improvemalware detection reliabilityVSAvoidstealth technique effectiveness

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent inverts the traditional detection approach by not directly searching for malware signatures, but rather by injecting a scanner module that monitors and compares process execution states. Instead of asking 'is this malware present?', the system asks 'is the process execution state consistent with expected behavior?', thereby detecting stealth malware through behavioral anomalies rather than direct identification

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent introduces a scanner module as an intermediary component that sits between the malware and the detection system. This scanner module injects into the target process and monitors execution without being detected by the malware's stealth mechanisms, serving as a mediator that can observe and report malware behavior while maintaining detection reliability

Inventive Principle:

Principle #24Intermediary (Mediator)

2Difficulty of detecting and measuring

If RootKit is used to censor file names and hide registry entries, then the malware's concealment capability is improved, but the ease of detecting and measuring malware deteriorates

Engineering Contradiction:

Improvemalware detectabilityVSAvoidprocess information visibility

Core Design Contradiction:

Difficulty of detecting and measuringVSLoss of information

Solution Approach 1:

The patent applies preliminary action by injecting the scanner module into the target process before the malware can execute its concealment routines. The scanner module establishes monitoring of process execution state, memory contents, and register values in advance, ensuring that when malware attempts to hide information, the scanner has already captured the authentic state for comparison and detection

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS7743418B2Identifying malware that employs stealth techniques

Publication Date: 2010.06.22 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A method, software system, and computer-readable medium are provided for determining whether a malware that implements stealth techniques is resident on a computer. In one exemplary embodiment, a method is provided that obtains a first set of data that describes the processes that are reported as being active on the computer in a non-interrupt environment. Then, the method causes program execution to be interrupted at runtime so that an analysis of the active processes on the computer may be performed. After program execution is interrupted, a second set data that describes the processes that are reported as being active on the computer in a interrupt environment is obtained. By performing a comparison between the first and second sets of data, a determination may be made regarding whether the collected data contains inconsistencies that are characteristic of malware.