Systems and methods of protecting data from malware processes
The present disclosure pertains to methods and systems for protecting data or other resources from malware. A driver executing in kernel mode of an operating system on a computing device may monitor one or more processes allowed to execute on the computing device. The one or more processes may include a first executing process. The driver may detect an attempt by a first thread of execution of the first executing process to access a protected file. The driver, responsive to the detection may identify a file type of the protected file. The driver, responsive to the identification of the file type, may determine whether the process is in a list of processes allowed for the file type. The drive may, responsive to determination, determine whether to deny or allow the first thread to access the protected file while allowing another thread of the executing process to execute on the computing device.
1. A method of protecting data and resources from malware, comprising:
monitoring, by a driver executing in a kernel mode on a computing device, one or more processes allowed to execute in a user mode on the computing device, the one or more processes including a first executing process having a plurality of threads;
detecting, by the driver, an attempt by a first thread of the plurality of threads of the first executing process from the user mode to access a protected file in the kernel mode;
identifying, by the driver responsive to the detection, from a plurality of file types, a file type of the protected file of the kernel mode using at least one of content or metadata of the protected file;
identifying, by the driver from a plurality of lists of processes, a list of processes for the identified file type, each list of the plurality of lists of processes defining a corresponding plurality of types of operations permitted for a corresponding file type;
determining, by the driver, responsive to the identification of the file type, whether the attempt by the first thread corresponds to one of the plurality of permitted types of operations defined in the list of processes allowed for the identified file type; and
determining, by the driver, responsive to the determination, whether to deny or allow the first thread from the user mode to access the protected file in the kernel mode while allowing another thread of the plurality of threads of the first executing process to execute in the user mode on the computing device.
2. The method of claim 1 , wherein determining whether the process is in the list of processes comprising:
identifying a type of operation corresponding to the attempt to access the protected file; and
comparing the type of operation to the plurality of types of operations defined in the list of processes allowed for the identified file type of the protected file.
3. The method of claim 1 , wherein determining whether the executing process is in the list of processes comprising:
generating a hash value of the process; and
comparing the generated hash value to hash values in the list of processes allowed for the file type of the protected file.
4. The method of claim 1 , wherein identifying the file type comprises identifying the file type using at least one of a file extension of the protected file, the information associated with the protected file, or the content of the protected file.
5. The method of claim 1 , comprising determining, responsive to determining that the executing process is excluded from the list of processes allowed for the file type of the protected file, to deny the first thread to access the protected file, while allowing another thread of the executing process to execute on the computing device.
6. The method of claim 1 , comprising determining to allow the first thread to access the protected file, responsive to determining that the process is in the list of processes allowed for the file type of the protected file, and that no other criteria from a rule engine is applicable.
7. The method of claim 1 , comprising determining to allow the first thread to access the protected file, responsive to determining that the process is in the list of processes allowed for the file type of the protected file, and that additional criteria from a rule engine is met, the additional criteria based on at least one of a context of the process or information about the protected file.
8. The method of claim 1 , wherein determining whether to deny or allow the first thread to access the protected file comprises determining whether the first thread is attempting to write, copy or transmit any portion of content of the protected file.
9. The method of claim 1 , wherein determining whether to deny or allow the process further comprising:
identifying a memory allocation size for the executing process to access the protected file; and
comparing the size of the memory allocation size to a minimum memory allocation threshold for the executing process specified in a criteria.
10. A system of protecting data and resources from malware, the system comprising:
an event handler driver executable in a kernel mode on one or more hardware processors of a computing device, the event handler driver configured to:
monitor one or more processes allowed to execute in a user mode on the computing device, the one or more processes including a first executing process having a plurality of threads;
detect an attempt by a first thread of the plurality of threads of the first executing process from the user mode to access a protected file in the kernel mode; and
identify, responsive to the detection, from a plurality of file types, a file type of the protected file of the kernel mode using at least one of content or metadata of the protected file; and
a rule engine executable in the kernel mode on the one or more hardware processors, the rule engine configured to:
identify, from a plurality of lists of processes, a list of processes for the identified file type, each list of the plurality of lists of processes defining a corresponding plurality of types of operations permitted for a corresponding file type;
determine, responsive to the identification of the file type, whether the attempt by the first thread of execution corresponds to one of the plurality of permitted types of operations defined in the list of processes allowed for the identified file type; and
determine, responsive to the determination, whether to deny or allow the first thread from the user mode to access the protected file in the kernel mode while allowing another thread of the plurality of threads of the first executing process to execute in the user mode on the computing device.
11. The system of claim 10 , wherein the rule engine is configured to determine whether the process is in the list of processes by:
identifying a type of operation corresponding to the attempt to access the protected file; and
comparing the type of operation to the plurality of types of operations defined in the list of processes allowed for the identified file type of the protected file.
12. The system of claim 10 , wherein the rule engine is configured to determine whether the process is in the list of processes by:
generating a hash value of the process; and
comparing the generated hash value to hash values in the list of processes allowed for the file type of the protected file.
13. The system of claim 10 , wherein the rule engine is configured to identify the file type using at least one of a file extension of the protected file, the information associated with the protected file, or the content of the protected file.
14. The system of claim 10 , wherein the rule engine is configured to deny, responsive to determining that the executing process is excluded from the list of processes allowed for the file type of the protected file, the first thread to access the protected file, while allowing another thread of the executing process to execute on the computing device.
15. The system of claim 10 , wherein the rule engine is configured to allow the first thread to access the protected file, responsive to determining that the process is in the list of processes allowed for the file type of the protected file, and that no other criteria from a rule engine is applicable.
16. The system of claim 10 , wherein the rule engine is configured to allow the first thread to access the protected file, responsive to determining that the process is in the list of processes allowed for the file type of the protected file, and that additional criteria from a rule engine is met, the additional criteria based on at least one of a context of the process or information about the protected file.
17. The system of claim 10 , wherein the rule engine is configured to determine whether to deny or allow the first thread to access the protected file, by determining whether the first thread is attempting to write, copy or transmit any portion of content of the protected file.
18. The system of claim 10 , wherein the rule engine is configured to determine whether to deny or allow the process, by:
identifying a memory allocation size for the executing process to access the protected file; and
comparing the size of the memory allocation size to a minimum memory allocation threshold for the executing process specified in a criteria.