Back to results
US 8,028,301 B2Granted
Restricting recordal of user activity in a processing system
AssigneeSymantec Corporation
InventorsRolf Repasi, Simon Clausen
Life of this patent
Estimating the term…
Abstract
A method/system for restricting recordal of user activity in a processing system. In one form, the method comprises intercepting a kernel API call of the processing system 100, determining if a process initiating the kernel API call is malicious, and in response to a positive determination, terminating the determined process. A table can be updated with request information of the process and it can be determined if a trend of requests exists for the status of the input device, and in response to a positive determination of a trend, the process may be terminated.
Claims20
A method of restricting recordal of user activity in a processing system, the method comprising:
- establishing an application programming interface (API) hook between API calls and API procedures of the processing system;
- registering an occurrence of an event in the processing system;
- notifying one or more processes in a hook chain of the occurrence of the event;
- notifying a process that is not in the hook chain of the occurrence of the event;
- intercepting a kernel API call of the processing system, wherein the kernel API call is initiated by the process that is not in the hook chain;
- determining if the process initiating the kernel API call is malicious, wherein the process is a keylogger program;
- and,
- in response to a positive determination;
- determining parameters of the intercepted kernel API call, wherein the parameters comprise information relating to a request for an API procedure of the processing system;
- generating process information for the process initiating the kernel API call, wherein the process information comprises:
- identity information for the process;
- and
- the determined parameters of the intercepted kernel API call;
- generating a file comprising the process information;
- storing the file in a storage device, wherein the storage device stores additional files that comprise process information for additional processes that initiated malicious kernel API calls;
- performing a behavioral analysis of the process by continually polling the state of the file in the storage device;
- preventing the process from establishing a hook function in the hook chain of the processing system based on the behavioral analysis;
- terminating the process;
- notifying a user in real-time when the process is terminated;
- and
- displaying a list of previously terminated processes to the user, wherein the list is generated from the files stored in the storage device.
18 more elements
A processing system for restricting recordal of user activity in the processing system, comprising:
- a processor;
- memory in electronic communication with the processor;
- the processor configured to:
- establish an application programming interface (API) hook between API calls and API procedures of the processing system;
- register an occurrence of an event in the processing system;
- notify one or more processes in a hook chain of the occurrence of the event;
- notifying a process that is not in the hook chain of the occurrence of the event;
- intercept a kernel API call of the processing system, wherein the kernel API call is initiated by the process that is not in the hook chain;
- determine if the process initiating the kernel API call is malicious, wherein the process is a keylogger program;
- and,
- in response to a positive determination, the processor further configured to:
- determine parameters of the intercepted kernel API call, wherein the parameters comprise information relating to a request for an API procedure of the processing system;
- generate process information for the process initiating the kernel API call, wherein the process information comprises:
- identity information for the process;
- and
- the determined parameters of the intercepted kernel API call;
- generate a file comprising the process information;
- store the file in a storage device, wherein the storage device stores additional files that comprise process information for additional processes that initiated malicious kernel API calls;
- perform a behavioral analysis of the process by continually polling the state of the file in the storage device;
- prevent the process from establishing a hook function in the hook chain of the processing system based on the behavioral analysis;
- terminate the process;
- notify a user in real-time when the process is terminated;
- and
- display a list of previously terminated processes to the user,
- wherein the list is generated from the files stored in the storage device.
22 more elements
A method of restricting recordal of user activity in a processing system, the method comprising:
- establishing an application programming interface (API) hook between API calls and API procedures of the processing system;
- registering an occurrence of an event in the processing system;
- notifying one or more processes in a hook chain of the occurrence of the event;
- notifying a process that is not in the hook chain of the occurrence of the event;
- intercepting an input device API call of the processing system, wherein the input device API call is initiated by the process that is not in the hook chain;
- determining if the process initiating the input device API call is requesting a state of the input device in the processing system, wherein the process is a keylogger program;
- and,
- in response to a positive determination:
- determining parameters of the intercepted input device API call, wherein the parameters comprise information relating to a request for an API procedure of the processing system;
- generating process information for the process initiating the input device API call, wherein the process information comprises:
- identity information for the process;
- and
- the determined parameters of the intercepted input device API call;
- generating a file comprising the process information;
- storing the file in a storage device, wherein the storage device stores additional files that comprise process information for additional processes that initiated malicious input device API calls;
- updating a table with request information of the process, wherein the request information comprises the process information;
- performing a behavioral analysis of the process by continually polling the state of the file in the storage device;
- preventing the process from establishing a hook function in the hook chain of the processing system based on the behavioral analysis;
- terminating the process;
- notifying a user in real-time when the process is terminated;
- and
- displaying a list of previously terminated processes to the user, wherein the list is generated from the files stored in the storage device.
19 more elements
A processing system for restricting recordal of user activity in the processing system, comprising:
- a processor;
- memory in electronic communication with the processor;
- the processor configured to:
- establish an application programming interface (API) hook between API calls and API procedures of the processing system;
- register an occurrence of an event in the processing system;
- notify one or more processes in a hook chain of the occurrence of the event;
- notifying a process that is not in the hook chain of the occurrence of the event;
- intercept an input device API call of the processing system, wherein the input device API call is initiated by the process that is not in the hook chain;
- determine if the process initiating the input device API call is requesting a state of the input device in the processing system, wherein the process is a keylogger program;
- and,
- in response to a positive determination, the processor further configured to:
- determine parameters of the intercepted input device API call, wherein the parameters comprise information relating to a request for an API procedure of the processing system;
- generate process information for the process initiating the input device API call, wherein the process information comprises:
- identity information for the process;
- and
- the determined parameters of the intercepted input device API call;
- generate a file comprising the process information;
- store the file in a storage device, wherein the storage device stores additional files that comprise process information for additional processes that initiated malicious input device API calls;
- update a table with request information of the process, wherein the request information comprises the process information;
- perform a behavioral analysis of the process by continually polling the state of the file in the storage device;
- prevent the process from establishing a hook function in the hook chain of the processing system based on the behavioral analysis;
- terminate the process;
- notify a user in real-time when the process is terminated;
- and
- display a list of previously terminated processes to the user, wherein the list is generated from the files stored in the storage device.
22 more elements
A method of restricting recordal of user activity in a processing system, the method comprising:
- establishing an application programming interface (API) hook between API calls and API procedures of the processing system;
- registering an occurrence of an event in the processing system;
- notifying one or more processes in a hook chain of the occurrence of the event;
- notifying a process that is not in the hook chain of the occurrence of the event;
- intercepting a kernel device driver API call of the processing system, wherein the kernel device driver API call is initiated by the process that is not in the hook chain;
- determining if the process initiating the kernel device driver API is attempting to perform an activity comprising at least one of:
- replacement of an input device driver;
- modification of an input device driver;
- and,
- deletion of an input device driver;
- and,
- in response to a positive determination:
- determining parameters of the intercepted kernel device driver API call, wherein the parameters comprise information relating to a request for an API procedure of the processing system;
- generating process information for the process initiating the kernel device driver API call, wherein the process information comprises:
- identity information for the process;
- and
- the determined parameters of the intercepted kernel device driver API call;
- generating a file comprising the process information;
- storing the file in a storage device, wherein the storage device stores additional files that comprise process information for additional processes that initiated malicious kernel device driver API calls;
- performing a behavioral analysis of the process by continually polling the state of the file in the storage device;
- preventing the process from establishing a hook function in the hook chain of the processing system based on the behavioral analysis;
- restricting the process from performing the activity;
- notifying a user in real-time when the process is restricted, wherein the process is a keylogger program;
- and
- displaying a list of previously terminated processes to the user, wherein the list is generated from the files stored in the storage device.
22 more elements
A processing system for restricting recordal of user activity in the processing system comprising:
- a processor;
- memory in electronic communication with the processor;
- the processor configured to:
- establish an application programming interface (API) hook between API calls and API procedures of the processing system;
- register an occurrence of an event in the processing system;
- notify one or more processes in a hook chain of the occurrence of the event;
- notify a process that is not in the hook chain of the occurrence of the event;
- intercept a kernel device driver API call of the processing system, wherein the kernel device driver API call is initiated by the process that is not in the hook chain;
- determine if the process initiating the kernel device driver API call is attempting to perform an activity comprising at least one of:
- a replacement of an input device driver;
- a modification of an input device driver;
- and
- deletion of an input device driver;
- and
- in response to a positive determination, the processor further configured to:
- determine parameters of the intercepted kernel device driver API call, wherein the parameters comprise information relating to a request for an API procedure of the processing system;
- generate process information for the process initiating the kernel device driver API call, wherein the process information comprises:
- identity information for the process;
- and
- the determined parameters of the intercepted kernel device driver API call;
- generate a file comprising the process information;
- store the file in a storage device, wherein the storage device stores additional files that comprise process information for additional processes that initiated malicious kernel device driver API calls;
- perform a behavioral analysis of the process by continually polling the state of the file in the storage device;
- prevent the process from establishing a hook function in the hook chain of the processing system based on the behavioral analysis;
- restrict the process from performing the activity;
- notify a user in real-time when the process is restricted, wherein the process is a keylogger program;
- and
- display a list of previously terminated processes to the user, wherein the list is generated from the files stored in the storage device.
25 more elements
Dependencies are inferred from the claim text.