Operating system determination

• US 7,680,929 B1
• Filed: 07/30/2007
• Issued: 03/16/2010
• Est. Priority Date: 07/31/2006
• Status: Active Grant

• Current Assignee: Insurance Com LLC
• Original Assignee: Insurance Com LLC
• Inventors: Lyon, Gordon J.
• Primary Examiner(s): Chan; Wing F
• Assistant Examiner(s): THAI, NAM N
• Application Number:
  US11/881,998
• Time in Patent Office: 960 Days
• Field of Search: 709/220, 709/223, 709/224, 726/23, 726/25
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/166 IP fragmentation; TCP segmentation

Abstract

Determining the operating system of a target computer is disclosed. Subject information describing one or more attributes of the target computer is received. Reference information describing one or more attributes of a reference is received. The subject information is compared with the reference information. A score associated with the comparison is determined.

Claims

1. A system, including:

a processor; and

a memory, coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to;

receive subject information describing one or more attributes of the target computer, the subject information comprising at least a first portion and a second portion associated with a respective first test and second test;

receive reference information describing one or more attributes of a reference, the reference information comprising at least a third portion associated with the first test and a fourth portion associated with the second test;

compare the subject information with the reference information, including by;

comparing, in a first comparison, the first portion with the third portion; and

comparing, in a second comparison, the second portion with the fourth portion; and

determine a score associated with the first and second comparisons;

wherein a result of the first comparison has an associated weight that is different from a result of the second comparison;

wherein comparing the subject information with the reference information includes determining whether results of the first test are present in both the subject information and the reference information; and

wherein determining the score includes omitting the results of the first test if it is determined that the results of the first test are not present in both the subject information and the reference information.

2. The system of claim 1 wherein the score is based at least in part on points associated with a plurality of tests, and wherein at least two tests are associated with two different point values.

3. The system of claim 1 wherein the subject information includes a fingerprint.

4. The system of claim 1 wherein the reference information includes a fingerprint.

5. The system of claim 1 wherein receiving the subject information includes evaluating whether the subject information indicates problems.

6. The system of claim 1 wherein comparing the subject information with the reference information includes using an expression syntax.

7. The system of claim 1 wherein comparing the subject information with the reference information includes determining whether a value in the subject information is included in a range of values included in the reference information.

8. The system of claim 1 wherein the memory is configured to provide the processor with instructions which when executed further cause the processor to output the score.

9. The system of claim 1 wherein the reference is one of a plurality of references, and wherein the memory is configured to provide the processor with instructions which when executed further cause the processor to determine scores associated with comparisons of the subject information to information associated with each of the references in the plurality of references.

10. The system of claim 9 wherein the memory is configured to provide the processor with instructions which when executed further cause the processor to output a list of one or more references with which the target computer is an exact match.

11. The system of claim 9 wherein the memory is configured to provide the processor with instructions which when executed further cause the processor to output a list of one or more references with which the target computer is a close match.

12. The system of claim 11 wherein whether a reference is a close match is determined based at least in part on a threshold.

13. The system of claim 1 wherein the memory is configured to provide the processor with instructions which when executed further cause the processor to request submission of the subject information to a third party.

14. A method, comprising:

receiving subject information describing one or more attributes of the target computer, the subject information comprising at least a first portion and a second portion associated with a respective first test and second test;

receiving reference information describing one or more attributes of a reference, the reference information comprising at least a third portion associated with the first test and a fourth portion associated with the second test;

comparing, using a processor, the subject information with the reference information, including by;

comparing, in a first comparison, the first portion with the third portion; and

comparing, in a second comparison, the second portion with the fourth portion; and

determine a score associated with the first and second comparisons;

wherein a result of the first comparison has an associated weight that is different from a result of the second comparison;

wherein comparing the subject information with the reference information includes determining whether results of the first test are present in both the subject information and the reference information; and

wherein determining the score includes omitting the results of the first test if it is determined that the results of the first test are not present in both the subject information and the reference information.

15. The method of claim 14 wherein the subject information includes a fingerprint.

16. The method of claim 14 wherein the reference information includes a fingerprint.

17. A computer program embodied in a computer readable storage medium and comprising computer instructions for:

receiving subject information describing one or more attributes of the target computer, the subject information comprising at least a first portion and a second portion associated with a respective first test and second test;

receiving reference information describing one or more attributes of a reference, the reference information comprising at least a third portion associated with the first test and a fourth portion associated with the second test;

comparing, using a processor, the subject information with the reference information, including by;

comparing, in a first comparison, the first portion with the third portion; and

comparing, in a second comparison, the second portion with the fourth portion; and

determine a score associated with the first and second comparisons;

wherein a result of the first comparison has an associated weight that is different from a result of the second comparison;

wherein comparing the subject information with the reference information includes determining whether results of the first test are present in both the subject information and the reference information; and

wherein determining the score includes omitting the results of the first test if it is determined that the results of the first test are not present in both the subject information and the reference information.