US 11,082,444 B2 · Real-time detection of and protection from malware and steganography in a kernel mode

Abstract

A method for real-time detection of malware in a Kernel mode includes detecting a file operation request initiated by a process running in user mode. Malware detection analytics is performed on a file buffer associated with the detected file operation request to detect behavior indicating presence of malware. Responsive to detecting the behavior indicating the presence of the malware, the process responsible for initiating the detected file operation request is identified. A search for the identified process is performed on one or more of a blacklist of programs and a whitelist of programs to determine whether the identified process is a trusted process. Responsive to determining that the identified process is not a trusted process, a malware remediation action is executed against the identified process. Information describing the malware is transmitted to a client device.

Claims20

Dependent claims

A method for real-time detection of and protection from malware in a kernel mode, comprising:

detecting a file operation request initiated by a process running in user mode;
accessing a write buffer associated with the detected file operation request;
detecting whether the write buffer stores encrypted data;
identifying, responsive to detecting that the write buffer stores encrypted data, the process responsible for initiating the detected file operation request;
performing a search for the identified process on one or more of a blacklist of programs and a whitelist of programs to determine whether the identified process is a trusted process;
and
responsive to determining that the identified process is not a trusted process:
executing a malware remediation action against the identified process, and
transmitting information describing the malware to a client device.

6 more elements

A non-transitory computer readable storage medium storing instructions that when executed by at least one processor cause the at least one processor to:

detect a file operation request initiated by a process running in user mode;
accessing a write buffer associated with the detected file operation request;
detect whether the write buffer stores encrypted data;
identify, in response to detecting that the write buffer stores encrypted data, the process responsible for initiating the detected file operation request;
perform a search for the identified process on one or more of a blacklist of programs and a whitelist of programs to determine whether the identified process is a trusted process;
and
in response to determining that the identified process is not a trusted process:
execute a malware remediation action against the identified process, and
transmit information describing the malware to a client device.

6 more elements

Dependencies are inferred from the claim text.

Real-time detection of and protection from malware and steganography in a kernel mode

Life of this patent

Real-time detection of and protection from malware and steganography in a kernel mode

Life of this patent

Abstract

Claims20