TECHNICAL FIELD

The invention relates to file integrity checking and host-based intrusion detection.

BACKGROUND

Modern computer networks are vulnerable to an ever widening variety of attacks and exploits. These attacks degrade the performance of individual hosts and of the network as a whole. They lead directly to the loss of critical data, privacy and, of course, money. A key characteristic of these attacks is the installation of unwanted programs/code into the host nodes that comprise the network. Backdoors, trojans, root-kits, and other types of malicious programs are injected into the networked computers unbeknownst to system users, admins, and owners. This injected malware then does the bidding of unknown masters elsewhere on the network.

Host-based file integrity checkers are sometimes used to detect intrusive attacks that may have compromised critical operating system files. Conventional host-based integrity checkers utilize a database of critical properties for key system files. During this process, the host computer applies this set of stored file signatures to detect whether the critical files of the operating system have been compromised. The file signatures which are used in the integrity checking process for the host computer are typically stored on the host system, or in a database stored on one other computer, and the system checking processes for a given host computer are run on that host computer. Storage of the signature data on the host itself (or a single other computer) renders the integrity checkers vulnerable to compromise. That is, an intrusive or malware program on that host can alter the signatures to prevent detection and conceal its intrusion. In addition, malware, once installed on the host, can prevent or otherwise disrupt the integrity checking processes which are run on that host.

SUMMARY

In general, a distributed file integrity checking system is described. The described peer integrity checking system (PICS) may negate an attack by storing a properties database amongst nodes of a peer-to-peer network of hosts, some or all of which co-operate to protect and watch over each other. The described peer integrity checking system enables the use of Peer-to-Peer technology as a means of network self-defense: the network itself will sense and react to intrusive attacks in a distributed and fault-tolerant manner. Co-operative software processes may be deployed on the nodes that automatically examine the distributed database stored within the peer-to-peer network and detect suspicious or obviously compromised nodes without human intervention, alerting other nodes, users, and network owners/operators to their presence. In one embodiment, a peer integrity checking software package can be installed on thousands of network-connected hosts (e.g., Internet hosts), allowing for cooperative, fault-tolerant intrusion detection and network defense.

In one example, the techniques use a peer-to-peer networking construct called a distributed hash table (DHT) to store the file signature data for individual hosts throughout the peer-to-peer network. As a result, there is no single point of compromise of this database, since it is stored in a “scattered” fashion across potentially hundreds or even thousands of peer computers. This group of peer nodes cooperates so that nodes protect each other. The distributed nature of the file signature storage also allows for one node to explicitly check on the integrity of other nodes, or to “mine” the distributed database of signatures for all nodes for patterns of intrusion.

The techniques described herein use peer-to-peer networking techniques to check the integrity of files stored on a host computer against a database of file “signatures” produced at a prior time and presumed to represent a “good” system state. The comparison detects file system changes associated with unwanted, intrusive programs such as malware.

The distributed nature of the system contrasts with the centralized nature of previous systems. The techniques may utilize functions as a kind of “neighborhood watch” in which peer groups of computers cooperate to ensure each others integrity. As a result, likelihood of a successful intrusive malware attack can be substantially reduced since in order for such an attack to go undetected, many more than just a single host within the peer group must be compromised.

The techniques apply peer-to-peer networking technology to file integrity checking and host-based intrusion detection.

The techniques described herein may be applied to software intrusion detection, anti-virus software products or virtually any software product that seeks to protect a host or an enterprise from the installation of malware by either internal or external means.

The details of one or more embodiments of the invention are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the invention will be apparent from the description and drawings, and from the claims.

