System and method for detecting peer-to-peer network software

• US 20060248525A1
• Filed: 04/12/2005
• Published: 11/02/2006
• Est. Priority Date: 04/12/2005
• Status: Active Grant

• Current Assignee: Kroll Information Assurance LLC
• Original Assignee: Tiversa Ip, Inc.
• Inventors: Hopkins, Samuel P.
• Granted Patent: US 9,178,940 B2
• Time in Patent Office: Days
• US Class Current: 717/177
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1068 Discovery involving direct consultation or announcement among potential requesting and potential source peers

Abstract

The present invention provides a method for detecting whether or not a computer system is, has, or can participate in a Peer-to-Peer network. Scanning software is executed on a target system to be scanned or a remote system which will scan a target system. If Peer-to-Peer client software is detected the scanning software can notify the enforcing user, disable the Peer-to-Peer client software, or both.

Claims

1. A method for detecting peer-to-peer network software, said method comprising the steps of:

a. executing a scanning program on a target computer;

b. said scanning program

i. reviewing at least one of said target computer'"'"'s registry keys or values;

ii. comparing said registry keys or values to a known value; and

iii. making a decision that peer-to-peer client software is installed on said target computer based on a result of said comparison.

11. A method as set forth in any one of claims 1, 2, 4, 5, 9, or 10, further comprising the step of notifying an enforcing user of said scanning program of said result.

12. A method as set forth in any one of claims 1, 2, 4, 5, 9, or 10, further comprising the step of disabling said peer-to-peer network software based on said result.

2. A method for detecting peer-to-peer network software, said method comprising the steps of:

a. executing a scanning program on a target computer;

b. said scanning program

i. reviewing at least one of said target computer'"'"'s files or directories;

ii. comparing said files or directories to a known value; and

iii. making a decision that peer-to-peer client software is installed on said target computer based on a result of said comparison.

3. A method as set forth in claim 2 wherein said files or directories are available over a private network and said scanning program is executed on a computer system separate from said target computer.

4. A method for detecting peer-to-peer network software, said method comprising the steps of:

a. executing a scanning program on a target computer;

b. said scanning program

i. comparing said target system'"'"'s running processes to a known value; and

ii. making a decision that peer-to-peer client software is installed on said target computer based on a result of said comparison.

5. A method for detecting peer-to-peer network software, said method comprising the steps of:

a. executing a scanning program on a target computer;

b. said scanning program

i. counting a number of file types that are contained on said target computer;

ii. comparing said number to a set threshold; and

iii. making a decision that peer-to-peer client software is installed on said target computer based on a result of said comparison.

6. A method as set forth in claim 5 wherein said file types are music based.

7. A method as set forth in claim 5 wherein said file type are movie based.

8. A method as set forth in claim 5 wherein said file types are ebook based.

9. A method for detecting peer-to-peer network software, said method comprising the steps of:

a. executing a scanning program on a target computer;

b. said scanning program

i. reviewing said target computer'"'"'s network communications;

ii. comparing said communications to a known value; and

iii. making a decision that peer-to-peer client software is installed on said target computer based on a result of said comparison.

10. A method for detecting peer-to-peer network software, said method comprising the steps of:

a. executing a scanning program;

b. said scanning program

i. connecting to a target computer'"'"'s TCP/IP ports;

ii. establishing a successful connection with said target computer;

iii. comparing said TCP/IP port number to a known value; and

iv. making a decision that peer-to-peer client software is installed on said target computer based on a result of said comparison.

13. A system for detecting peer-to-peer network software, said system comprising:

a. a storage medium for storing instructions;

b. a user input device for receiving user input; and

c. a processor unit operable to process said user input and to use said instructions to execute a scanning program to;

i. review a feature of said target computer, wherein said feature is selected from the group consisting of said target computer'"'"'s registry keys, values, files, directories, and network communications;

ii. compare said feature of said target computer to a known value; and

iii. decide if peer-to-peer client software is installed on said target computer based on a result of said comparison.

17. A system as set forth in claim 13 wherein said files or directions are available over a private network and said scanning program is executed on a computer system separate from said target computer.

21. A system as set forth in any one of claims 13-16 wherein an enforcing user of said scanning program is notified of said result.

22. A system as set forth in any one of claims 13-16 wherein said peer-to-peer network software is disabled based on said result.

14. A system for detecting peer-to-peer network software, said system comprising:

a. a storage medium for storing instructions;

b. a user input device for receiving user input; and

c. a processor unit operable to process said user input and to use said instructions to execute a scanning program to;

i. compare said target system'"'"'s running processes to a known value; and

ii. decide if that peer-to-peer client software is installed on said target computer based on a result of said comparison.

15. A system for detecting peer-to-peer network software, said system comprising:

a. a storage medium for storing instructions;

b. a user input device for receiving user input; and

c. a processor unit operable to process said user input and to use said instructions to execute a scanning program to;

i. count a number of file types that are contained on said target computer; and

ii. compare said number to a set threshold; and

iii. decide if peer-to-peer client software is installed on said target computer based on a result of said comparison.

18. A system as set forth in claim 15 wherein said file types are music based.

19. A system as set forth in claim 15 wherein said file types are movie based.

20. A system as set forth in claim 15 wherein said file types are ebook based.

16. A system for detecting peer-to-peer network software, said system comprising:

a. a storage medium for storing instructions;

b. a user input device for receiving user input; and

c. a processor unit operable to process said user input and to use said instructions to execute a scanning program to;

i. connect to a target computer'"'"'s TCP/IP ports;

ii. establish a successful connection with said target computer;

iii. compare said TCP/IP port number to a known value; and

iv. decide if peer-to-peer client software is installed on said target computer based on a result of said comparison.