Portal monitoring based anti-malware framework: design and implementation

Most malware are introduced into a computer system by applications that communicate with the outside world. These applications (called portals) are key components for system security. This paper presents an efficient anti-malware framework under Linux by monitoring the behavior of these portals and isolating the files they induced. The files created or modified by the monitored applications will be marked with a suspicious label; when a file with suspicious label is accessed, a predefined scanning tool or other mechanisms in user-land will be invoked to check the file. The file labeling and access mediation are done in kernel, thus is mandatory and transparent to user applications; the scanning mechanisms are implemented in user land, thus flexible for user to customize. Experiment result under Linux shows the framework can prevent malware´s intrusion with small performance penalty