Method and system for the detection of file system filter driver based rootkits
View Patent ↗A method, system, and computer program product for detecting hidden files and folders that may be installed by or as part of a rootkit provides the capability to identify the method that is used to hide the files and folders, will continue working even if the operating system is modified, and is suitable for real-time detection of hidden files and folders. A method for detecting a rootkit comprises the steps of generating a plurality of query input/output request packets, each query input/output request packet requesting information relating to a file system directory folder, transmitting a generated query input/output request packet to each file system driver object, receiving a result including the requested information relating to a file system directory folder from each file system driver object, and determining differences among each result, to determine information relating to a file system directory folder that is removed by at least one file system driver object.
1. A method for detecting a rootkit, comprising the steps of:
generating a plurality of query input/output request packets, each query input/output request packet requesting information relating to a file system directory folder;
transmitting a generated query input/output request packet to each file system driver object;
receiving a result including the requested information relating to a file system directory folder from each file system driver object; and
determining differences among each result, to determine information relating to a file system directory folder that is removed by at least one file system driver object.
2. The method of claim 1 , wherein each file system driver object comprises one of a base file system driver object, a file system filter driver object, a rootkit file system filter driver object, or an input/output manager.
3. The method of claim 1 , wherein the result including the requested information includes a listing of files and folders that are present in the file system directory folder.
4. The method of claim 1 , wherein the differences are determined by determining at least one file or folder that is present in a result including a listing of files and folders received from at least one file system driver object is not present in a result including a listing of files and folders received from at least one other file system driver object.
5. The method of claim 4 , wherein each file system driver object comprises one of a base file system driver object, a file system filter driver object, a rootkit file system filter driver object, or an input/output manager.
6. A system for detecting a rootkit comprising:
a processor operable to execute computer program instructions;
a memory operable to store computer program instructions executable by the processor; and
computer program instructions stored in the memory and executable to perform the steps of:
generating a plurality of query input/output request packets, each query input/output request packet requesting information relating to a file system directory folder;
transmitting a generated query input/output request packet to each file system driver object;
receiving a result including the requested information relating to a file system directory folder from each file system driver object; and
determining differences among each result, to determine information relating to a file system directory folder that is removed by at least one file system driver object.
7. The system of claim 6 , wherein each file system driver object comprises one of a base file system driver object, a file system filter driver object, a rootkit file system filter driver object, or an input/output manager.
8. The system of claim 6 , wherein the result including the requested information includes a listing of files and folders that are present in the file system directory folder.
9. The system of claim 6 , wherein the differences are determined by determining at least one file or folder that is present in a result including a listing of files and folders received from at least one file system driver object is not present in a result including listing of files and folders received from at least one other file system driver object.
10. The system of claim 9 , wherein each file system driver object comprises one of a base file system driver object, a file system filter driver object, a rootkit file system filter driver object, or an input/output manager.
11. A computer program product for detecting a rootkit comprising:
a computer readable storage medium;
computer program instructions, recorded on the computer readable storage medium, executable by a processor, for performing the steps of
generating a plurality of query input/output request packets, each query input/output request packet requesting information relating to a file system directory folder;
transmitting a generated query input/output request packet to each file system driver object,
receiving a result including the requested information relating to a file system directory folder from each file system driver object; and
determining differences among each result, to determine information relating to a file system directory folder that is removed by at least one file system driver object.
12. The method of claim 11 , wherein each file system driver object comprises one of a base file system driver object, a file system filter driver object, a rootkit file system filter driver object, or an input/output manager.
13. The method of claim 11 , wherein the result including the requested information includes a listing of files and folders that are present in the file system directory folder.
14. The method of claim 11 , wherein the differences are determined by determining at least one file or folder that is present in a result including a listing of files and folders received from at least one file system driver object is not present in a result including a listing of files and folders received from at least one other file system driver object.
15. The method of claim 14 , wherein each file system driver object comprises one of a base file system driver object, a file system filter driver object, a rootkit file system filter driver object, or an input/output manager.
16. The method of claim 1 , wherein each generated query input/output request packet is sent directly to a dispatch routine of each file system driver object.
17. The method of claim 1 , wherein the result from each file system driver object is stored in a separate result memory.
18. The method of claim 1 , wherein each generated query input/output request packet is sent directly to base file system driver object dispatch routines and to dispatch routines of every file system driver object layered on top of a base file system volume device object.