Method and system for detecting a keylogger on a computer

• US 20070180520A1
• Filed: 01/18/2006
• Published: 08/02/2007
• Est. Priority Date: 01/18/2006
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Horne, Jefferson
• Granted Patent: US 7,721,333 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06F 2221/031 Protect user input by software means
• CPC Class Codes: G06F 2221/2107 File encryption

Abstract

A method and system for detecting a keylogger on a computer is described. One illustrative embodiment creates, in a memory of the computer, a hidden window; generates a unique, unpredictable data pattern; inputs, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user; scans running processes in the memory other than a keylogger detection process for the unique, unpredictable data pattern; and performs a secondary scan of a suspect process, the suspect process having an associated buffer that contains the unique, unpredictable data pattern.

Claims

1. A method for detecting a keylogger on a computer, comprising:

creating, in a memory of the computer, a hidden window;

generating a unique, unpredictable data pattern;

inputting, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user;

scanning running processes in the memory other than a keylogger detection process for the unique, unpredictable data pattern; and

performing a secondary scan of a suspect process, the suspect process having an associated buffer that contains the unique, unpredictable data pattern.

2. The method of claim 1, further comprising reporting the suspect process as a suspected keylogger, when the secondary scan confirms that the suspect process is likely to be a keylogger.

3. The method of claim 1, wherein the hidden window comprises a single-pixel window on a display of the computer.

4. The method of claim 1, wherein the hidden window is created outside of a display buffer of the computer.

5. The method of claim 1, wherein the unique, unpredictable data pattern is based on a random value.

6. The method of claim 1, wherein the unique, unpredictable data pattern is input to the hidden window multiple times.

7. The method of claim 1, wherein inputting, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user comprises using an application program interface (API) of an operating system of the computer.

8. The method of claim 1, wherein inputting, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user comprises using a keyboard driver that is integral to the keylogger detection process.

9. The method of claim 1, wherein performing the secondary scan of the suspect process comprises:

identifying at least one application program interface (API) used by the suspect process; and

determining whether the suspect process uses the at least one API in a manner that is characteristic of a keylogger.

10. A system, comprising:

a detection module to detect a keylogger on a computer, the detection module being configured to;

create, in a memory of the computer, a hidden window;

generate a unique, unpredictable data pattern;

input, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user;

scan running processes in the memory other than a keylogger detection process for the unique, unpredictable data pattern; and

perform a secondary scan of a suspect process, the suspect process having an associated buffer that contains the unique, unpredictable data pattern.

11. The system of claim 10, wherein the detection module is further configured to report the suspect process as a suspected keylogger, when the secondary scan confirms that the suspect process is likely to be a keylogger.

12. The system of claim 10, wherein the hidden window comprises a single-pixel window on a display of the computer.

13. The system of claim 10, wherein the detection module is configured to create the hidden window outside of a display buffer of the computer.

14. The system of claim 10, wherein the unique, unpredictable data pattern is based on a random value.

15. The system of claim 10, wherein the detection module is configured to input the unique, unpredictable data pattern to the hidden window multiple times.

16. The system of claim 10, wherein the detection module is configured to input, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user by using an application program interface (API) of an operating system of the computer.

17. The system of claim 10, wherein the detection module is configured to input, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user by using a keyboard driver that is integral to the keylogger detection process.

18. The system of claim 10, wherein, during the secondary scan of the suspect process, the detection module is configured to:

identify at least one application program interface (API) used by the suspect process; and

determine whether the suspect process uses the at least one API in a manner that is characteristic of a keylogger.

19. A system for detecting a keylogger on a computer, comprising:

means for creating, in a memory of the computer, a hidden window;

means for generating a unique, unpredictable data pattern;

means for inputting, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user;

means for scanning running processes in the memory other than a keylogger detection process for the unique, unpredictable data pattern; and

means for performing a secondary scan of a suspect process, the suspect process having an associated buffer that contains the unique, unpredictable data pattern.

20. The system of claim 19, further comprising means for reporting the suspect process as a suspected keylogger, when the secondary scan confirms that the suspect process is likely to be a keylogger.

21. A computer-readable storage medium containing program instructions to detect a keylogger on a computer, comprising:

a first instruction segment to create, in a memory of the computer, a hidden window;

a second instruction segment to generate a unique, unpredictable data pattern;

a third instruction segment to input, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user;

a fourth instruction segment to scan running processes in the memory other than a keylogger detection process for the unique, unpredictable data pattern; and

a fifth instruction segment to perform a secondary scan of a suspect process, the suspect process having an associated buffer that contains the unique, unpredictable data pattern.

22. The computer-readable storage medium of claim 21, further comprising a sixth instruction segment to report the suspect process as a suspected keylogger, when the secondary scan confirms that the suspect process is likely to be a keylogger.