System and method for preventing detection of a selected process running on a computer

• US 20090064331A1
• Filed: 10/27/2008
• Published: 03/05/2009
• Est. Priority Date: 07/14/1999
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Lyle, Michael P., Ross, Robert F., Maricondo, James R.
• Granted Patent: US 7,827,605 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A system and method are disclosed for preventing detection of a monitoring process running on a computer. A request to access a process file concerning a process running on the computer is received from a user. It is determined whether the process file requested by the user relates to the selected process. If the requested process file does not relate to the selected process, the user is provided with access to the file.

Claims

1. A method for concealing from a user a monitoring process running on a computer, comprising:

receiving from the user a request to access a process file concerning a process running on the computer;

determining whether the process file requested by the user relates to the monitoring process; and

in the event that the requested process file does not relate to the monitoring process, providing the user with access to the process file;

wherein the process file associated with the monitoring process is associated with a process information pseudo file system and contains process information about the monitoring process; and

providing the user with access to the process file would reveal to the user existence of the monitoring process.

2. The method of claim 1 further comprising denying access to the file if the requested process file does relate to the monitoring process.

3. The method of claim 1 further comprising providing to the user an indication that the requested process file does not exist if the requested file does relate to the monitoring process.

4. The method of claim 1 wherein the operating system of the computer is Solaris 7 and the step of receiving comprises receiving all requests to access files within the /proc file system.

5. The method of claim 1 wherein the monitoring process relates to monitoring the activities of the user with respect to the computer.

6. The method of claim 1 further comprising using the monitoring process to monitor an interaction of the user with a deception environment.

7. The method of claim 1 further comprising replacing one or more operating system functions in a system entry table with a new program configured to perform said step of receiving from the user a request to access a process file concerning a process running on the computer.

8. The method of claim 1 further comprising replacing one or more operating system functions in a system entry table with a new program configured to provide in response to the request, in the event it is determined that the process file requested by the user relates to the monitoring process, an indication that the requested file does not exist.

9. A system for concealing from a user a monitoring process running on a computer, comprising:

a computer configured to monitor an interaction of the user with a deception environment;

receive from the user a request to access a process file concerning a process running on the computer, determine whether the process file requested by the user relates to the monitoring process and, in the event that the requested file does not relate to the monitoring process, provide the user with access to the process file;

wherein the process file is associated with a process information pseudo file system and contains process information about the monitoring process; and

providing the user with access to the process file would reveal to the user existence of the monitoring process.

10. The system of claim 9 wherein the computer is further configured to deny access to the file if the requested process file does relate to the monitoring process.

11. The system of claim 9 wherein the computer is further configured to provide to the user an indication that the requested process file does not exist if the requested file does relate to the monitoring process.

12. The system of claim 9 wherein the operating system of the computer is Solaris 7 and the computer is configured to filter all requests to access process files within the /proc file system, including by allowing access to one or more process files not associated with the monitoring process and to deny access to one or more process files associated with the monitoring process.

13. The system of claim 9 wherein the monitoring process is used to monitor an interaction of the user with a deception environment.

14. A computer program product for concealing from a user a selected process running on a computer, the computer program product being embodied in a computer readable medium and comprising computer instructions for:

monitoring an interaction of the user with a deception environment;

receiving from the user a request to access a process file concerning a process running on the computer;

determining whether the process file requested by the user relates to the monitoring process; and

in the event that the requested process file does not relate to the monitoring process, providing the user with access to the process file;

wherein the process file is associated with a process information pseudo file system and contains process information about the monitoring process; and

providing the user with access to the process file would reveal to the user existence of the monitoring process.

15. The computer program product of claim 14 further comprising computer instructions for denying access to the file if the requested process file does relate to the monitoring process.

16. The computer program product of claim 14 further comprising computer instructions for providing to the user an indication that the requested process file does not exist if the requested file does relate to the monitoring process.

17. The computer program product of claim 14 wherein the operating system of the computer is Solaris 7 and the step of receiving comprises receiving all requests to access files within the /proc file system.

18. The computer program product of claim 14 wherein the monitoring process relates to monitoring the activities of the user with respect to the computer.

19. The computer program product of claim 14 further comprising computer instructions for replacing one or more operating system functions in a system entry table with a new program configured to perform said step of receiving from the user a request to access a process file concerning a process running on the computer.

20. The computer program product of claim 14 further comprising computer instructions for replacing one or more operating system functions in a system entry table with a new program configured to provide in response to the request, in the event it is determined that the process file requested by the user relates to the monitoring process, an indication that the requested file does not exist.