Periodic filesystem integrity checks

• US 20050182969A1
• Filed: 04/08/2005
• Published: 08/18/2005
• Est. Priority Date: 06/09/2003
• Status: Abandoned Application

• Current Assignee: Industrial Defender, Inc. (Capgemini SE)
• Original Assignee: Industrial Defender, Inc. (Capgemini SE)
• Inventors: Muegge, Adam, Kawano, Kegan, Hope, Erik P., Mah, Andy G., Ginter, Andrew, McMillan, Brad, Jensen, Brett, Lopes, Rui Manuel Martins, Hutchinson, Tom
• Application Number:
  US11/102,050
• Publication Number:
  US 20050182969A1
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Described are techniques used in monitoring the performance, security and health of a system used in an industrial application. Agents included in the industrial network report data to an appliance or server. The appliance stores the data and determines when an alarm condition has occurred. Notifications are sent upon detecting an alarm condition. The alarm thresholds may be user defined. A threat thermostat controller determines a threat level used to control the connectivity of a network used in the industrial application.

Claims

1-166. -166. (canceled)

167. A method for performing periodic filesystem integrity checks comprising:

receiving two or more sets of filesystem entries, each set representing a grouping of one or more filesystem entries;

selecting zero or more entries from each set; and

performing integrity checking for each selected entry from each set during a reporting period.

168. The method of claim 167, wherein each of said two or more sets correspond to a predetermined classification level.

169. The method of claim 168, wherein if a first classification level is more important than a second classification level, said first classification level includes less entries than said second classification level.

170. The method of claim 168, wherein a number of entries from each set is determined in accordance with a level of importance associated with said set.

171. A computer program product for performing periodic filesystem integrity checks comprising code that:

receives two or more sets of filesystem entries, each set representing a grouping of one or more filesystem entries;

selects zero or more entries from each set; and

performs integrity checking for each selected entry from each set during a reporting period.

172. The computer program product of claim 171, wherein each of said two or more sets correspond to a predetermined classification level.

173. The computer program product of claim 172, wherein if a first classification level is more important than a second classification level, said first classification level includes less entries than said second classification level.

174. The computer program product of claim 172, wherein a number of entries from each set is determined in accordance with a level of importance associated with said set.