System and method for using login correlations to detect intrusions

• US 7,085,936 B1
• Filed: 08/30/2000
• Issued: 08/01/2006
• Est. Priority Date: 08/30/1999
• Status: Expired due to Term

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Moran, Douglas B.
• Primary Examiner(s): Morse, Gregroy
• Assistant Examiner(s): HENEGHAN, MATTHEW E
• Application Number:
  US09/651,854
• Time in Patent Office: 2,162 Days
• Field of Search: 713/200, 713/201, 726/22, 726/23
• US Class Current: 726/5
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

A system and method are disclosed for detecting intrusions in a host system on a network. The intrusion detection system comprises an analysis engine configured to use continuations and apply forward- and backward-chaining using rules. Also provided are sensors, which communicate with the analysis engine using a meta-protocol in which the data packet comprises a 4-tuple. A configuration discovery mechanism locates host system files and communicates the locations to the analysis engine. A file processing mechanism matches contents of a deleted file to a directory or filename, and a directory processing mechanism extracts deallocated directory entries from a directory, creating a partial ordering of the entries. A signature checking mechanism computes the signature of a file and compares it to previously computed signatures. A buffer overflow attack detector compares access times of commands and their associated files. The intrusion detection system further includes a mechanism for checking timestamps to identify and analyze forward and backward time steps in a log file.

Claims

1. A method for detecting intrusions on a host, comprising:

collecting information from a logfile located on the host; and

analyzing the logfile, including by using a time decay function to compute a suspicion value for an entry in the logfile including by computing a probability for an end of a session with which the entry is associated.

2. A method as recited in claim 1, wherein the logfile is sulog and the session is an su session.

3. A computer program product for detecting intrusions on a host, the computer program product being embodied in a computer readable medium and comprising computer instructions for:

collecting information from a logfile located on the host; and

analyzing the logfile, including by using a time decay function to compute a suspicion value for an entry in the logfile including by using the time decay function to compute a probability for an end of a session with which the entry is associated.

4. A computer program product as recited in claim 3, wherein the logfile is sulog and the session is an su session.