System and method for real time monitoring and control of networked computers

• US 6,961,765 B2
• Filed: 04/06/2001
• Issued: 11/01/2005
• Est. Priority Date: 04/06/2000
• Status: Expired due to Fees

• Current Assignee: TerraCerta, Inc.
• Original Assignee: BBX Technologies, Inc.
• Inventors: Terry, Robert F.
• Primary Examiner(s): Jean, Frantz B.
• Application Number:
  US09/827,891
• Publication Number:
  US 20020026505A1
• Time in Patent Office: 1,670 Days
• Field of Search: 709/217, 709/218, 709/219, 709/246, 709/223, 709/224, 713/201, 714/2
• US Class Current: 709/224
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A method of real time monitoring and control of networked computers, includes: providing a monitoring computer unit and client computer unit both capable of being communicatively coupled to a network system; and detecting states in the client computer and transmitting the detected states to the monitoring computer unit via the network system.

Claims

1. A system of real time monitoring and control of networked computers, comprising:

a monitoring computer unit capable of being communicatively coupled to a network system; and

a client computer unit capable of being communicatively coupled to the network system, the client computer including a client application that can detect states in the client computer and transmit the detected states to the monitoring computer unit via the network system to permit detection of an unauthorized software program or unauthorized behavior within the client computer unit, wherein the detection of the states includes calculating a maximum base count for entries in a defined registry segment in an internal registry in the client computer unit, and wherein the client application detects states in the client computer by detecting a modification of registry configuration data in the internal registry in the client computer unit.

2. The system of claim 1 wherein the monitoring computer unit includes an administrator application capable to analyze the transmitted detected states.

3. The system of claim 2 wherein the administrator application is capable to issue command signal to control the client computer unit in response to a particular detected state in the client computer unit.

5. The system of claim 1, wherein the internal registry comprises a database that is used by an operating system in order to store configuration information.

6. The system of claim 1, wherein the client application retrieves the registry configuration data and stores the registry configuration data into a memory array, prior to detecting a modification of the registry configuration data.

7. The system of claim 1, wherein the client application detects states in the client computer by detecting a modification of internal directory information and file information in the client computer.

8. The system of claim 7, wherein the client application retrieves the internal directory information and file information and stores the internal directory information and file information into a memory array, prior to detecting a modification of the internal directory information and file information.

9. The system of claim 1, wherein the internal directory information and file information are required to initiate a third-party application program.

10. The system of claim 1, wherein the internal directory information and file information are required to initiate the computer unit and the programs for initializing a third-party application program.

11. The system of claim 1, wherein the client application intercepts messages generated between an operating system and a third-party application program, in order to determine if an action by a user of the client computer is authorized.

12. The system of claim 11, wherein the client application monitors and intercepts the messages between the operating system and a third-party application program by accessing a memory buffer.

4. A method of real time monitoring and control of networked computers, comprising:

providing a monitoring computer unit and client computer unit both capable of being communicatively coupled to a network system; and

detecting states in the client computer unit and transmitting the detected states to the monitoring computer unit via the network system to permit detection of an unauthorized software program or unauthorized behavior within the client computer unit, wherein the detection of the states includes calculating a maximum base count for entries in a defined registry segment in an internal registry in the client computer unit, and detecting the states in the client computer unit comprises detecting a modification of registry configuration data in the internal registry in the client computer unit.

13. The method of claim 4, wherein the internal registry comprises a database that is used by an operating system in order to store configuration information.

14. The method of claim 4, further comprising:

analyzing, by the monitoring computer unit, the transmitted detected states that are transmitted by the client computer unit.

15. The method of claim 4, further comprising:

issuing, by the monitoring computer unit, a command signal to control the client computer unit in response to a particular detected state in the client computer unit.

16. The method of claim 4, further comprising:

prior to detecting a modification of the registry configuration data, retrieving the registry configuration data, and storing the registry configuration data into a memory array.

17. The method of claim 4, further comprising:

detecting a modification of internal directory information and file information in the client computer unit.

18. The method of claim 17, further comprising:

retrieving the internal directory information and file information, and storing the internal directory information and file information into a memory array, prior to detecting a modification of the internal directory information and file information.

19. The method of claim 4, further comprising:

intercepting messages generated between an operating system and a third-party application program, in order to determine if an action by a user of the client computer unit is authorized.

20. The method of claim 19, wherein the act of intercepting the messages between the operating system and a third-party application program comprises accessing a memory buffer.