System for identifying the presence of Peer-to-Peer network software applications

• US 20070078990A1
• Filed: 11/15/2006
• Published: 04/05/2007
• Est. Priority Date: 04/12/2005
• Status: Active Grant

• Current Assignee: Kroll Information Assurance LLC
• Original Assignee: Tiversa Ip, Inc.
• Inventors: Hopkins, Samuel
• Granted Patent: US 7,697,520 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1061 using node-based peer discovery mechanisms static access to replicated servers H04L67/1006; service discovery H04L67/51

Abstract

A system and method for detecting peer-to-peer network software operating on a target computer. A target file is created, and placed in one or more folders on the target computer. A search is issued on a Peer-to-Peer network for the target file. Peer-to-peer software is detected to be operating on the target computer in accordance with results of the search.

Claims

1. A method for detecting peer-to-peer network software operating on a target computer, comprising:

a. creating a target file, and placing said target file in one or more folders on the target computer;

b. issuing a search on a Peer-to-Peer network for said target file; and

c. detecting whether peer-to-peer software is operating on the target computer in accordance with results of the search.

2. The method of claim 1, wherein the target file is placed in a plurality of folders on the target computer.

3. The method of claim 1, wherein the target file contains data that uniquely identifies the target computer.

4. The method of claim 3, wherein said data is encrypted.

5. The method of claim 3, wherein said data includes an IP address of the target computer.

6. The method of claim 3, wherein said data contains a name of the target computer.

7. The method of claim 3, wherein said data contains a name of a user of the target computer.

8. The method of claim 3, wherein said data contains an email address of a user of the target computer.

9. The method of claim 3, wherein said data contains information entered by a network administrator or operator responsible for monitoring the target computer.

10. The method of claim 1, wherein said the method is implemented at least in part using software that executes on the target computer.

11. The method of claim 1, wherein said the method is implemented at least in part using software that executes on a computer different from the target computer.

12. The method of claim 1, further comprising:

notifying at least one of a firewall, an intrusion detection system, a router, or an application, that peer-to-peer software has been detected, wherein the notification is performed based in accordance with an output of the detecting step.

13. A system for detecting peer-to-peer network software operating on a target computer, comprising:

a storage medium for storing instructions; and

a user input device for receiving user input; and

a processor unit operable to process said user input and to use said instructions to;

create a target file;

place said target file in one or more folders on the target computer;

issue a search on a Peer-to-Peer network for said target file; and

detect whether peer-to-peer software is operating on the target computer in accordance with results of the search.

14. The system of claim 13, wherein the processor unit is operable to process said user input and to use said instructions to place the target file in a plurality of folders on the target computer.

15. The system of claim 14, wherein the target file contains data that uniquely identifies the target computer.

16. The system of claim 15, wherein said data is encrypted.

17. The system of claim 15, wherein said data includes an IP address of the target computer.

18. The system of claim 15, wherein said data contains a name of the target computer.

19. The system of claim 15, wherein said data contains a name of a user of the target computer.

20. The system of claim 15, wherein said data contains an email address of a user of the target computer.

21. The system of claim 15, wherein said data contains information entered by a network operator or administrator responsible for monitoring the target computer.

22. The system of claim 13, wherein said system is implemented using software that executes at least in part on the target computer.

23. The system of claim 13, wherein said system is implemented using software that executes at least in part on a computer different from the target computer.

24. The system of claim 13, wherein the processor unit automatically notifies at least one of a firewall, an intrusion detection system, a router, or an application, upon detection of peer-to-peer software.

25. A system for the detection of one or more Peer-to-Peer network software applications operating on a target computer, comprising:

.

a. means for creating a target file, and placing said target file in one or more folders on the target computer;

b. means for issuing a search on a Peer-to-Peer network for said target file; and

c. means for detecting whether peer-to-peer software is operating on the target computer in accordance with results of the search.

26. The system of claim 25, wherein the target file is placed in a plurality of folders on the target computer.

27. The system of claim 25, wherein the target file contains data that uniquely identifies the target computer.

28. A method for detecting peer-to-peer network participation of a first node, comprising:

a. monitoring network data of the first node; and

b. issuing a search for a predetermined term on a peer-to-peer network while monitoring the network data;

c. detecting peer-to-peer participation of the first node in the peer-to-peer network if said monitoring identifies the predetermined term being transmitted to the first node.

29. The method of claim 28, further comprising notifying an administrator responsible for monitoring the node if peer-to-peer participation is detected.

30. The method of claim 28, further comprising automatically blocking data access to the first node if peer-to-peer participation is detected.

31. The method of claim 28, further comprising disabling peer-to-peer software associated with the first node if peer-to-peer participation is detected.

32. The method of claim 28, wherein the first node resides on a corporate computer network.

33. The method of claim 28, wherein the first node resides on a home computer network.

34. A system for detecting peer-to-peer network participation, comprising:

a. means for monitoring network data of the first node;

b. means for issuing a search for a predetermined term on a peer-to-peer network while the means for monitoring the network data is operating; and

c. means for detecting peer-to-peer participation of the first node in the peer-to-peer network if said means for monitoring identifies the predetermined term being transmitted to the first node.