Method and computer program product for identifying or managing vulnerabilities within a data processing network

• US 7,752,669 B2
• Filed: 07/31/2008
• Issued: 07/06/2010
• Est. Priority Date: 12/12/2003
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Venkateshamurthy, Shivakumara, Aswathanarayana, Tejasvi, Palliyil, Sudarshan
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): Zee; Edward
• Application Number:
  US12/184,225
• Publication Number:
  US 20090019547A1
• Time in Patent Office: 705 Days
• Field of Search: 713/200, 713/187, 713/188, 726/24, 726/25
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Provided are methods, apparatus and computer programs for identifying vulnerabilities to viruses of hacking. Hash values are computed and stored for resources stored on systems within a network. If a first resource or a collection of resources (such as files comprising an operating system, Web Browser or mail server) is associated with a vulnerability, hash values for the first resource or collection of resources are compared with the stored hash values to identify systems which have the vulnerability. Messages may be sent to the people responsible for the vulnerable systems, or the vulnerability may be removed by automatic downloading of patches or service packs.

Claims

1. A method comprising:

computing a set of first hash values derived from and representing a plurality of replicas of a resource, wherein the replicas of the resource are stored on respective data processing systems within a network and the computing of the first hash values is at a first time

storing the computed set of first hash values;

after computing and storing the set of first hash values, computing second hash values for the replicas of the resource, wherein the computing of the second hash values is at a second time;

at a central server within the network, automatically comparing the first and second hash values to find new hash values changed between computing the first hash values and computing the second hash values;

statistically observing a creation pattern of the new hash values to evaluate likelihood of a virus infection; and

selecting replicas of the resource for virus scanning responsive to the statistically observed creation pattern;

wherein the statistically observed creation pattern includes a pattern wherein more than a certain predetermined number of the first hash values of the replicas of the resource have remained unchanged as compared to the second hash values and wherein a period defined by the difference between the first and second times is a period of more than a certain predetermined interval.

2. The method of claim 1, wherein the statistically observed creation pattern further includes a pattern wherein, for the replicas of the resource, more than a certain predetermined number of hash values are different than one another at a time after the second time.

3. The method of claim 1, further comprising:

distributing a set of decoy files over multiple machines;

computing and monitoring hash values for the set of decoy files; and

in response to detecting a change in a decoy file, generating an alert.

4. The method of claim 3 further comprising, in response to detecting the change in the decoy file, isolating a selected machine containing the changed decoy file from the network.

5. A computer program product including at least one tangible, non-transitory computer readable medium, said at least one computer readable medium having instructions stored thereon for execution by at least one computer system, wherein the instructions, when executed by the at least one computer system, cause the at least one computer system to implement a method comprising the steps of:

computing a set of first hash values derived from and representing a plurality of replicas of a resource, wherein the replicas of the resource are stored on respective data processing systems within a network and the computing of the first hash values is at a first time

storing the computed set of first hash values;

after computing and storing the set of first hash values, computing second hash values for the replicas of the resource, wherein the computing of the second hash values is at a second time;

at a central server within the network, automatically comparing the first and second hash values to find new hash values changed between computing the first hash values and computing the second hash values;

statistically observing a creation pattern of the new hash values to evaluate the likelihood of a virus infection; and

selecting replicas of the resource for virus scanning responsive to the statistically observed creation pattern;

wherein the statistically observed creation pattern includes a pattern wherein more than a certain predetermined number of the first hash values of the replicas of the resource have remained unchanged as compared to the second hash values and wherein a period defined by the difference between the first and second times is a period of more than a certain predetermined interval.

6. The computer program product of claim 5, wherein the statistically observed creation pattern further includes a pattern wherein, for the replicas of the resource, more than a certain predetermined number of hash values are different than one another at a time after the second time.

7. The computer program product of claim 5, wherein said at least one computer readable medium further includes instructions stored thereon for execution by the at least one computer system for:

distributing a set of decoy files over multiple machines;

computing and monitoring hash values for the set of decoy files; and

in response to detecting a change in a decoy file, generating an alert.

8. The computer program product of claim 5, wherein said at least one computer readable medium further includes instructions stored thereon for execution by the at least one computer system for, in response to detecting the change in the decoy file, isolating a selected machine containing the changed decoy file from the network.

9. A method comprising the steps of:

updating, at successive update times, virus definitions for scanning resources stored on a data processing system;

scanning the stored resources for viruses in first and second scanning instances responsive to the virus definitions updated at respective first and second ones of the update times;

computing hash values for the resources at the first and second update times;

for a selected one of the resources, calculating a value indicative of how long the respective resource has remained unchanged between earliest and latest clear virus scans of the selected one of the resources;

for the selected one of the resources, comparing the calculated value to a pre-selected reference value, the pre-selected reference value having been selected at least partially based on an expected time that a target virus may exist but remain undetected;

prioritizing virus scanning of the selected one of the resources based at least partially on the result of comparing the calculated value to the pre-selected reference value and on whether more than a predetermined number of hash values for the selected one of the resources are equal for the earliest and latest clear virus scans;

updating the virus definitions at a next update time;

scanning at least one high-priority resource for viruses in a next scanning instance responsive to the virus definitions updated at the next time; and

after scanning the at least one high-priority resource, deferring virus scanning of at least one low-priority resource until a period of low system activity.

10. The method of claim 9, further comprising excluding at least one low-priority resource from scanning by classifying it as safe.

11. The method of claim 9, further comprising detecting the period of low system activity with an inactivity timer.

12. The method of claim 9, wherein the prioritizing virus scanning of the selected one of the resources is further based at least partially on whether more than a certain predetermined number of hash values for the resource are different than one another at the next update time.

15. The computer program product of claim 12, wherein the method further comprises detecting the period of low system activity with an inactivity timer.

16. The computer program product of claim 12, wherein the prioritizing virus scanning of the selected one of the resources is further based at least partially on whether more than a certain predetermined number of hash values for the resource are different than one another at the next update time.

13. A computer program product including at least one tangible, non-transitory computer readable medium, said at least one computer readable medium having instructions stored thereon for execution by at least one computer system, wherein the instructions, when executed by the at least one computer system, cause the at least one computer system to implement a method comprising the steps of:

updating, at successive update times, virus definitions for resources stored on a data processing system;

scanning the stored resources for viruses in first and second scanning instances responsive to the virus definitions updated at respective first and second ones of the update times;

computing hash values for the resources at the first and second update times;

for a selected one of the resources, calculating a value indicative of how long the respective resource has remained unchanged between earliest and latest clear virus scans of the selected one of the resources;

for the selected one of the resources, comparing the calculated value to a pre-selected reference value, the pre-selected reference value having been selected at least partially based on an expected time that a target virus may exist but remain undetected;

prioritizing virus scanning of the selected one of the resources based at least partially on the result of comparing the calculated value to the pre-selected reference value and on whether hash values for the selected one of the resources are equal for the earliest and latest clear virus scans;

updating the virus definitions at a next update time;

scanning at least one high-priority resource for viruses in a next scanning instance responsive to the virus definitions updated at the next time; and

after scanning at least one high-priority resource, deferring virus scanning of at least one low-priority resource until a period of low system activity.

14. The computer program product of claim 13, wherein the method further comprises excluding at least one low-priority resource from scanning by classifying it as safe.