Vulnerable Driver Activity Detection for Kernel-User Malware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus software struggles to detect malware that operates simultaneously in the operating system's kernel and user modes, particularly when it utilizes legitimate components, leading to compromised detection accuracy.
Innovation Solution
A system and method for detecting harmful files by analyzing the activity of drivers using an interception module, activity analysis module, and a dangerous driver database to determine a danger coefficient, followed by searching for and quarantining linked files based on the driver's activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software blocks or removes legitimate drivers to detect malware, then malware detection capability is improved, but computer functionality deteriorates and data loss occurs
Solution Approach 1:
The system segments the detection process into two independent parts: driver behavior monitoring in kernel mode and file analysis in user mode. This allows the antivirus to monitor suspicious driver activities without blocking or removing legitimate drivers, thereby maintaining computer functionality while improving malware detection capability through behavioral analysis
Solution Approach 2:
The system introduces an intermediary component that acts as a bridge between kernel mode drivers and user mode analysis. This intermediary captures driver activities and passes them for analysis without requiring direct intervention or blocking of the drivers themselves, thus maintaining system operation while enabling detection
2Measurement precision
If antivirus software monitors driver activities in kernel mode, then malware detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system divides the complex monitoring task into separate kernel mode and user mode components. The kernel mode driver handles low-level activity capture while the user mode application performs high-level analysis, reducing the complexity burden on any single component while maintaining high detection accuracy
Solution Approach 2:
The system creates a universal framework that can monitor multiple driver types and behaviors through a common architecture. The driver activity monitor and analysis system are designed to handle various driver functionalities through standardized interfaces, reducing overall system complexity through multi-functionality
3Reliability
If antivirus software uses combined kernel mode and user mode detection methods, then malware identification capability is improved, but difficulty in controlling harmful activity increases
Solution Approach 1:
The system merges kernel mode monitoring capabilities with user mode analysis functions into a unified detection framework. This combination allows comprehensive malware identification while managing control complexity through integrated architecture that coordinates both modes systematically
Data Source
Figure 1
Figure 2
Figure 3
AI summary
System and method for detecting a harmful file include detecting activity of a driver in an operating system by intercepting an Application Programming Interface (API) request from the driver to an application. The detected activity of the driver is analyzed to determine if the driver is dangerous. A search for a file that is linked to the application and that uses the driver is performed, in response to determining that the driver is dangerous. The file found by the search is declared to be harmful.