Real-time detection of and protection from malware and steganography in a kernel mode
A method for real-time detection of malware in a Kernel mode includes detecting a file operation request initiated by a process running in user mode. Malware detection analytics is performed on a file buffer associated with the detected file operation request to detect behavior indicating presence of malware. Responsive to detecting the behavior indicating the presence of the malware, the process responsible for initiating the detected file operation request is identified. A search for the identified process is performed on one or more of a blacklist of programs and a whitelist of programs to determine whether the identified process is a trusted process. Responsive to determining that the identified process is not a trusted process, a malware remediation action is executed against the identified process. Information describing the malware is transmitted to a client device.
1. A method for real-time detection of and protection from malware in a kernel mode, comprising:
detecting a file operation request initiated by a process running in user mode;
accessing a write buffer associated with the detected file operation request;
detecting whether the write buffer stores encrypted data;
identifying, responsive to detecting that the write buffer stores encrypted data, the process responsible for initiating the detected file operation request;
performing a search for the identified process on one or more of a blacklist of programs and a whitelist of programs to determine whether the identified process is a trusted process; and
responsive to determining that the identified process is not a trusted process:
executing a malware remediation action against the identified process, and
transmitting information describing the malware to a client device.
2. The method of claim 1 , wherein the detecting of the file operation request comprises:
determining, from a file handle corresponding to the file operation request, whether the file operation request corresponds to a write operation; and
responsive to determining that the file operation request corresponds to the write operation, intercepting the file operation request.
3. The method of claim 2 , wherein the intercepting of the file operation request comprises:
determining, by a filter manager, whether a minifilter driver is registered to intercept file operation requests; and
responsive to determining that the minifilter driver is registered to intercept file operation requests, transmitting, by the filter manager, the file operation request to the minifilter driver.
4. The method of claim 1 , wherein detecting whether the write buffer stores encrypted data comprises performing one or more of Monte Carlo approximation, entropy determination, serial coefficient analysis, arithmetic mean determination, Chi-Square determination, and standard deviation determination to determine whether data within the file buffer is encrypted.
5. The method of claim 1 , wherein:
the determining that the identified process is not a trusted process further comprises locating the identified process on the blacklist of programs; and
the executing of the malware remediation action further comprises:
terminating a write operation associated with the detected file operation request,
terminating the detected file operation request by deleting the detected file operation request from memory, and
isolating a disk file image associated with the identified process.
6. The method of claim 1 , further comprising responsive to locating the identified process on the whitelist of programs, ignoring, by a minifilter driver, the detected file operation request.
7. The method of claim 1 , wherein the determining whether the identified process is a trusted process further comprises transmitting, responsive to not locating the process on the blacklist of programs or the whitelist of programs, a request to the client device to authorize the identified process.
8. The method of claim 7 , wherein the determining that the identified process is not a trusted process further comprises receiving, responsive to the transmitting of the request to the client device to authorize the identified process, a message from the client device that the identified process is not authorized.
9. The method of claim 8 , further comprising adding the identified process to the blacklist of programs.
10. The method of claim 1 , further comprising adding, responsive to receiving a message from the client device that the identified process is authorized, the identified process to the whitelist of programs.
11. A non-transitory computer readable storage medium storing instructions that when executed by at least one processor cause the at least one processor to:
detect a file operation request initiated by a process running in user mode;
accessing a write buffer associated with the detected file operation request;
detect whether the write buffer stores encrypted data;
identify, in response to detecting that the write buffer stores encrypted data, the process responsible for initiating the detected file operation request;
perform a search for the identified process on one or more of a blacklist of programs and a whitelist of programs to determine whether the identified process is a trusted process; and
in response to determining that the identified process is not a trusted process:
execute a malware remediation action against the identified process, and
transmit information describing the malware to a client device.
12. The non-transitory computer readable storage medium of claim 11 , wherein the instructions that cause the at least one processor to detect the file operation request further comprises instructions that cause the at least one processor to:
determine, from a file handle corresponding to the file operation request, whether the file operation request corresponds to a write operation; and
intercept the file operation request in response to determining that the file operation request corresponds to the write operation.
13. The non-transitory computer readable storage medium of claim 12 , wherein the instructions that cause the at least one processor to intercept the file operation request further comprises instructions that cause the at least one processor to:
determine, by a filter manager, whether a minifilter driver is registered to intercept file operation requests; and
transmit, by the filter manager, the file operation request to the minifilter driver, responsive to determining that the minifilter driver is registered to intercept file operation requests.
14. The non-transitory computer readable storage medium of claim 11 , wherein the instructions that cause the at least one processor to detect whether the write buffer stores encrypted data further comprises instructions that cause the at least one processor to perform one or more of Monte Carlo approximation, entropy determination, serial coefficient analysis, arithmetic mean determination, Chi-Square determination, and standard deviation determination to determine whether data within the file buffer is encrypted.
15. The non-transitory computer readable storage medium of claim 11 , wherein:
the instructions that cause the at least one processor to determine that the identified process is not a trusted process further comprises instructions that cause the at least one processor to locate the identified process on the blacklist of programs; and
the instructions that cause the at least one processor to execute the malware remediation action further comprises instructions that cause the at least one processor to:
terminate a write operation associated with the detected file operation request,
terminate the detected file operation request by deleting the detected file operation request from memory, and
isolate a disk file image associated with the identified process.
16. The non-transitory computer readable storage medium of claim 11 , further storing instructions that when executed by the at least one processor causes the at least one processor to ignore, by a minifilter driver, the detected file operation request, responsive to locating the identified process on the whitelist of programs.
17. The non-transitory computer readable storage medium of claim 11 , wherein the instructions that cause the at least one processor to determine whether the identified process is a trusted process further comprises instructions that cause the at least one processor to transmit a request to the client device to authorize the identified process, responsive to not locating the process on the blacklist of programs or the whitelist of programs.
18. The non-transitory computer readable storage medium of claim 17 , wherein the instructions that cause the at least one processor to determine that the identified process is not a trusted process further comprises instructions that cause the at least one processor to receive a message from the client device that the identified process is not authorized, responsive to the transmitting of the request to the client device to authorize the identified process.
19. The non-transitory computer readable storage medium of claim 18 , further storing instructions that when executed by the at least one processor cause the at least one processor to add the identified process to the blacklist of programs.
20. The non-transitory computer readable storage medium of claim 11 , further storing instructions that when executed by the at least one processor cause the at least one processor to add the identified process to the whitelist of programs, responsive to receiving a message from the client device that the identified process is authorized.