US 10,122,739 B2 · Rootkit detection system and method

Abstract

A rootkit detection method includes obtaining, from a target system, first data comprising raw data stored in a data block of a storage drive, checking the first data for known malware, and generating a first alert if known malware is detected. The drive may include a public key, the first data may include a digital signature based on the key, and checking the first data may include validating the signature. The method may be performed by a system management resource that sends a management request for a particular data block. Second data, corresponding to an operating system access of the particular data block, may be obtained and compared to the first data. Responsive to detecting a discrepancy, generating a second alert. The system management resource may be a cloud based server, a premise installed appliance, premise installed security server, or a management controller of the target system.

Claims19

Dependent claims

A rootkit detection method comprising:

obtaining, from a storage subsystem of a target information handling system, first data comprising raw data stored in a particular data block of a storage drive within the storage subsystem, wherein obtaining the first data includes sending, by a system management resource, a management request for the particular data block;
checking the first data for known malware;
and
responsive to detecting known malware in the first data, generating a malware alert;
obtaining host configuration information from the target information handling system, wherein the host configuration information includes storage configuration information indicating storage controllers and storage drives associated with the target information handling system;
comparing a current storage configuration of the target information handling system to a previous storage configuration and, responsive to detecting a discrepancy, generating a storage configuration alert.

3 more elements

A rootkit detection method comprising:

obtaining, from a storage subsystem of a target information handling system, first data comprising raw data stored in a data block of a storage drive within the storage subsystem, wherein the target information handling system comprises a managed host system configured to respond to a management request for host configuration information by returning configuration lists indicating storage controllers and storage drives associated with the target information handling system;
checking the first data for known malware;
responsive to detecting known malware in the first data, generating a malware alert;
sending a management request for current host configuration information for the target information handling system;
and
comparing a current storage configuration of the target information handling system to a previous storage configuration and, responsive to detecting a discrepancy, generating a storage configuration alert.

3 more elements

Dependencies are inferred from the claim text.

Rootkit detection system and method

Life of this patent

Rootkit detection system and method

Life of this patent

Abstract

Claims19