System and method for below-operating system trapping of driver filter attachment
View Patent ↗A system for protecting an electronic system against malware includes an operating system configured to execute on the electronic device, a driver coupled to the operating system, and a below-operating-system security agent. The below-operating-system security agent is configured to identify one or more resources for changing filters of the driver, trap an attempted access of the one or more resources that originates from the operational level of the operating system, access one or more security rules to determine whether the attempted access is indicative of malware, and operate at a level below all of the operating systems of the electronic system accessing the one or more resources for changing filters of the driver.
1. A system for protecting an electronic system against malware, comprising:
an operating system configured to execute on the electronic device;
a driver coupled to the operating system;
a below-operating-system security agent configured to:
identify one or more resources for changing filters of the driver;
trap an attempted access of the one or more resources that originates from the operational level of the operating system;
access one or more security rules to determine whether the attempted access is indicative of malware; and
operate at a level below all of the operating systems of the electronic system accessing the one or more resources for changing filters of the driver.
2. The system of claim 1 , wherein determining whether the attempted access is indicative of malware comprises:
determining an entity that made the attempt; and
determining whether the entity was authorized to make the attempt.
3. The system of claim 2 , wherein determining whether the entity was authorized to make the attempt comprises determining whether the entity is digitally signed.
4. The system of claim 2 , wherein determining whether the entity was authorized to make the attempt comprises determining whether the entity is the owner of a device coupled to the driver.
5. The system of claim 1 , wherein the resources are identified by pages of virtual memory containing the resources.
6. The system of claim 1 , wherein the resources are identified by addresses of physical memory containing the resources.
7. The system of claim 1 , wherein the attempted access includes an execution of a function for attaching or detaching a filter to the driver.
8. The system of claim 7 , wherein determining whether the attempted access is indicative of malware comprises determining whether an entity making the attempt is authorized to execute the function.
9. The system of claim 1 , wherein the attempted access includes an execution of a subfunction of a function for attaching or detaching a filter to the driver.
10. The system of claim 9 , wherein determining whether the attempted access is indicative of malware comprises determining whether the subfunction was executed without executing the function.
11. The system of claim 1 , wherein the attempted access includes an attempted change to permissions for a data structure of the driver.
12. The system of claim 1 , wherein the attempted access includes an attempted access of a data structure of the driver.
13. The system of claim 1 , wherein determining whether the attempted access is indicative of malware comprises considering whether the attempted access was a read, write or execute request.
14. A method for protecting an electronic device against malware, comprising:
identifying one or more resources for changing a filter of a driver of an operating system of the electronic device;
trapping an attempted access of the one or more resources that originates from the operational level of the operating system; and
accessing one or more security rules to determine whether the attempted access is indicative of malware;
wherein the trapping of the attempted access and determining whether the attempted access is indicative of malware is conducted at a level below all of the operating systems of the electronic device accessing one or more resources for changing the filter.
15. The method of claim 14 , wherein determining whether the attempted access is indicative of malware comprises:
determining an entity that made the attempt; and
determining whether the entity was authorized to make the attempt.
16. The method of claim 15 , wherein determining whether the entity was authorized to make the attempt comprises determining whether the entity is digitally signed.
17. The method of claim 15 , wherein determining whether the entity was authorized to make the attempt comprises determining whether the entity is the owner of a device coupled to the driver.
18. The method of claim 14 , wherein the resources are identified by pages of virtual memory containing the resources.
19. The method of claim 14 , wherein the resources are identified by addresses of physical memory containing the resources.
20. The method claim 14 , wherein the attempted access includes an execution of a function for attaching or detaching a filter to the driver.
21. The method of claim 20 , wherein determining whether the attempted access is indicative of malware comprises determining whether an entity making the attempt is authorized to execute the function.
22. The method of claim 14 , wherein the attempted access includes an execution of a subfunction of a function for attaching or detaching a filter to the driver.
23. The method of claim 22 , wherein determining whether the attempted access is indicative of malware comprises determining whether the subfunction was executed without executing the function.
24. The method of claim 14 , wherein the attempted access includes an attempted change to permissions for a data structure of the driver.
25. The method of claim 14 , wherein the attempted access includes an attempted access of a data structure of the driver.
26. The method of claim 14 , wherein determining whether the attempted access is indicative of malware comprises considering whether the attempted access was a read, write or execute request.
27. An article of manufacture, comprising:
a computer readable medium; and
computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
identify one or more resources for changing a filter of a driver of an operating system of the electronic device;
trap an attempted access of the one or more resources that originates from the operational level of the operating system; and
access one or more security rules to determine whether the attempted access is indicative of malware;
wherein the instructions cause the processor to trap the attempted access and determine whether the attempted access is indicative of malware at a level below all of the operating systems of the electronic device accessing the one or more resources for changing the filter.
28. The article of claim 27 , wherein causing the processor to determine whether the attempted access is indicative of malware comprises causing the processor to:
determine an entity that made the attempt; and
determine whether the entity was authorized to make the attempt.
29. The article of claim 28 , wherein causing the processor to determine whether the entity was authorized to make the attempt comprises causing the processor to determine whether the entity is digitally signed.
30. The article of claim 28 , wherein causing the processor to determine whether the entity was authorized to make the attempt comprises causing the processor to determine whether the entity is the owner of a device coupled to the driver.
31. The article of claim 27 , wherein the resources are identified by pages of virtual memory containing the resources.
32. The article of claim 27 , wherein the resources are identified by addresses of physical memory containing the resources.
33. The article claim 27 , wherein the attempted access includes an execution of a function for attaching or detaching a filter to the driver.
34. The article of claim 33 , wherein causing the processor to determine whether the attempted access is indicative of malware comprises causing the processor to determine whether an entity making the attempt is authorized to execute the function.
35. The article of claim 27 , wherein the attempted access includes an execution of a subfunction of a function for attaching or detaching a filter to the driver.
36. The article of claim 27 , wherein causing the processor to determine whether the attempted access is indicative of malware comprises causing the processor to determine whether the subfunction was executed without executing the function.
37. The article of claim 27 , wherein the attempted access includes an attempted change to permissions for a data structure of the driver.
38. The article of claim 27 , wherein the attempted access includes an attempted access of a data structure of the driver.
39. The article of claim 27 , wherein causing the processor to determine whether the attempted access is indicative of malware comprises causing the processor to consider whether the attempted access was a read, write or execute request.