Watchdog Filter Driver for Malware Process Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing systems are vulnerable to malware attacks that can stop, corrupt, or convert application processes without user realization, leading to potential exposure of confidential information and lack of application recovery capabilities, which can result in irreversible damage.
Innovation Solution
A watchdog filter driver integrated with the operating system kernel intercepts process access requests to detect and prevent malware events, determine the originating process, and relaunch terminated processes to maintain system integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application processes run with reduced resource access rights, then system security is improved, but the processes become vulnerable to termination and corruption by malware
Solution Approach 1:
The patent segments the security protection mechanism by introducing a separate watchdog process that independently monitors protected processes. This watchdog runs with elevated privileges and can detect/prevent malware actions that the protected process cannot detect itself, thus resolving the contradiction between running with reduced rights and protecting against termination.
Solution Approach 2:
The watchdog process acts as an intermediary between the protected process and the operating system kernel. It intercepts termination signals and corruption attempts before they reach the protected process, allowing the process to maintain reduced access rights while still being protected from harmful actions.
2Device complexity
If the operating system does not support application recovery and restart, then system simplicity is maintained, but process crashes result in permanent damage
Solution Approach 1:
The watchdog process performs preliminary actions by continuously monitoring the health and state of protected processes. When it detects a crash or termination event, it automatically initiates recovery by relaunching the affected process, thus providing recovery capability without requiring complex OS-level support.
Solution Approach 2:
The system implements self-service recovery where the watchdog process autonomously detects failures and relaunches crashed processes without user intervention or complex OS recovery mechanisms. This provides application recovery capability while maintaining operating system simplicity.
3Ease of operation
If malware is allowed to terminate processes, then system resource management is simplified, but confidential information may be exposed
Solution Approach 1:
The watchdog process applies preliminary anti-action by detecting and blocking malware attempts to terminate protected processes before they can occur. This prevents information exposure while maintaining simple resource management, as the watchdog intercepts harmful termination signals at the process level rather than requiring complex information protection mechanisms.
Data Source
AI summary
In one embodiment, a malware protection system may protect a computing system from a malware event. A data storage device 150 may store a watchdog filter driver 240 integrated with an operating system kernel 210. A processor 120 may intercept a process access to an application process 220 with the watchdog filter driver 240 to detect a malware event. The processor 120 may use the watchdog filter driver 240 to determine an originating process for the malware event.