System Call Filtering for Malware Detection and File Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems for Unix-like operating systems, such as Unix®/Linux®, lack effective mechanisms to detect and remediate malicious activities, particularly in environments like Ubuntu® and Red Hat®.
Innovation Solution
A malware detection system that utilizes a behavioral monitor to inject process code into user space processes, generating kernel space filters to intercept system calls, and upon detection of malicious activity, kills the process and restores previous versions of processes or files from backup.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a behavioral monitor injects process code into user space processes and generates kernel space filters to intercept system calls, then malware detection capability is improved, but device complexity increases
Solution Approach 1:
The patent introduces a behavioral monitor as an intermediary component that sits between user space processes and the kernel. This monitor injects process code into user space processes and generates kernel space filters that intercept system calls before they reach the kernel, enabling detailed malware detection without requiring direct kernel modification for every monitoring operation.
Solution Approach 2:
The system divides malware detection functionality into separate components: user space process monitoring, kernel space filter generation, and centralized analysis. This segmentation allows each component to operate independently with specialized functions, improving detection capability while managing complexity through modular architecture.
2Measurement precision
If system calls are intercepted and analyzed in real-time, then malware detection accuracy is improved, but analysis time increases
Solution Approach 1:
The behavioral monitor performs preliminary actions by injecting process code into user space processes beforehand and pre-generating kernel space filters. This preparation allows system calls to be intercepted and routed for analysis without delay during actual malware detection operations, as the monitoring infrastructure is already in place.
Solution Approach 2:
The system implements efficient call routing that skips unnecessary analysis steps for known benign system calls while directing suspicious calls for detailed examination. This selective processing reduces overall analysis time while maintaining high detection accuracy for malicious activities.
3Measurement precision
If kernel space filters are generated to intercept system calls, then system call monitoring capability is improved, but memory overhead increases
Solution Approach 1:
The behavioral monitor creates copies of system call interception functionality in kernel space filters rather than duplicating entire process monitoring contexts. This copying approach enables comprehensive system call monitoring while using minimal memory, as only the essential filter code and state information are duplicated in kernel space.
4Reliability
If the behavioral monitor operates in kernel space, then detection reliability is improved, but ease of operation decreases
Solution Approach 1:
The behavioral monitor serves as an intermediary layer that operates in kernel space for reliable system call interception while providing a simplified user space interface for configuration and management. This architecture maintains detection reliability through kernel space operations while improving ease of operation through user space accessibility.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A behavioral monitor executing in user space generates a plurality of filters corresponding to a plurality of processes executing in the user space. A first process transmits a system call to a corresponding filter of the plurality of filters in kernel space. The first process receives a signal from the corresponding filter. The first process analyzes the arguments submitted in the system call. The first process determines that the arguments may be associated with malicious activity. The first process generates an event and transmitting the event to the behavioral monitor. The behavioral monitor analyzes the event to determine whether the event is associated with malicious activity. The behavioral monitor causes a process group associated with the first process to cease executing and restores a previous version of the at least one file modified by the process group.