Event monitoring and collection

• US 8,122,122 B1
• Filed: 11/06/2006
• Issued: 02/21/2012
• Est. Priority Date: 11/08/2005
• Status: Active Grant

• Current Assignee: Forcepoint Federal Holdings LLC (Forcepoint LLC)
• Original Assignee: Raytheon Oakley Systems, Inc.
• Inventors: Clingenpeel, James E., Henry, Brent E.
• Primary Examiner(s): Moore, Ian N
• Assistant Examiner(s): Zuniga, Jackie
• Application Number:
  US11/556,942
• Time in Patent Office: 1,933 Days
• Field of Search: 714/48, 709223-226
• US Class Current: 709/224
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

Embodiments of the invention provide systems, software and methods for monitoring events on a computer. In a set of embodiments, a monitoring application monitors events on a monitored computer. Each of the monitored events may be analyzed, and based on the analysis, some or all of the monitored events may be collected. A variety of rules may be used in analyzing events. In some cases, collected events can be queued, for example, by storing a representation of each collected event in an event cache. When connectivity with a monitoring computer is available, a connection with the monitoring computer may be established, and/or the queued events may be transmitted to the monitoring computer. In a particular set of embodiments, the monitoring application is designed to avoid detection by a user of the monitored computer.

Claims

1. A system for monitoring events on a monitored computer, the system comprising:

a monitoring computer comprising a first processor and a first set of instructions, the first set of instructions operable, when executed by the first processor, to;

(a) monitor a network for a connection by a monitored computer;

(b) receive a set of one or more representations of events occurring on the monitored computer; and

(c) analyze the received representations of events to determine whether the events are associated with improper activities by a user of the monitored computer; and

a monitored computer comprising a second processor and a second set of instructions, the second set of instructions comprising instructions executable by the second processor, the second set of instructions comprising;

(aa) monitor a plurality of events, each of the plurality of events occurring at the monitored computer;

(bb) store a representation of each of the plurality of events in an event cache;

(cc) identify one of the plurality of events on the monitored computer as an event of interest, the identifying comprising;

analyzing each of the plurality of events against one or more rules defining characteristics of events that should be collected;

assigning at least one score to the plurality of events based on the analysis of the plurality of events;

comparing the at least one score assigned to the plurality of events with one or more thresholds; and

identifying one of the plurality of events on the monitored computer as the event of interest based on the comparison;

(dd) determine a window of interest prior in time to the event of interest, such that events falling within the window of interest should be collected;

(ee) identify, from the plurality of events, one or more events falling within the window of interest;

(ff) queue, for transmission to the monitoring computer, the representations of the event of interest and the one or more events falling within the window of interest;

(gg) establish connectivity with the monitoring computer; and

(hh) transmit the queued representations of events for reception by the monitoring computer;

wherein steps aa)-ff) occur while the monitored computer does not have connectivity with the monitoring computer, such that the queuing the representations of the event of interest and the one or more events falling within the window of interest comprises;

marking, in the event cache, each of the representations of the event of interest and the one or more events falling within the window of interest for later transmission to the monitoring computer.

2. A system as recited by claim 1, wherein the event of interest is selected from the group of events consisting of:

a use of an encrypted protocol,

a use of encrypted content,

a transmission of an electronic mail message,

a receipt of an electronic mail message,

an attachment of a file to an electronic mail message,

an attachment of an encrypted file to an electronic mail message,

a load of an HTML page in a web browser,

an unload of an HTML page in a web browser,

a web browser request for a URL,

a load of an image in a web browser,

a load of a script in a web browser,

a file download,

an HTML form reset,

an HTML form submit,

an HTML form text field input,

an HTML form personal information file input,

an HTML radio button selected,

an HTML check box selected,

an HTML check box unselected,

a selection from an HTML selection list,

a transmission of an instant messenger massage,

a receipt of an instant messenger message,

a creation of a file by an office application,

a read of a file by an office application,

a write to a file by an office application,

a creation of a print job,

a copy of data to a clipboard,

an entry of one or more keystrokes by a user,

an input from a mouse attached to the monitored computer,

a movement of a cursor over an HTML elements on a display,

a drive mount operation,

a drive dismount operation,

an unsuccessful attempt to mount a drive,

a file create operation,

a file copy operation,

a file move operation,

a file delete operation,

a file read operation,

a file rename operation,

a file write operation, and

data satisfying one or more configured regular expressions.

3. The system of claim 1, wherein assigning at least one score to the plurality of events based on the analysis of the plurality of events comprises:

determining content of the plurality of events that should be scored; and

creating a numeric score for the content that is determined should be scored.

4. A system for monitoring events on a monitored computer, the system comprising:

a monitored computer comprising a processor and a set of instructions executable by the processor, the set of instructions operable, when executed by the processor, to;

monitor a plurality of events, each of the plurality of events occurring at the monitored computer;

for each of the plurality of events;

generate an identifier corresponding to the event;

search an event cache for an existing identifier matching the generated identifier;

store a copy of the event as a representation of the event if an existing identifier matching the generated identifier is not found in the search of the event cache; and

store the generated identifier as the representation of the event if an existing identifier matching the generated identifier for the event is found in the search of the event cache;

analyze each of the plurality of events against one or more rules defining characteristics of events that should be collected and, based on the analysis of the plurality of events, assign at least one score to the plurality of events;

compare the at least one score assigned to the plurality of events with one or more thresholds, and, based on the comparison, identify one of the plurality of events on the monitored computer as an event of interest;

queue the representation of the event of interest for transmission to a monitoring computer;

determine that a set of one or more events occurring prior in time to the event of interest should be collected;

determine a window of interest prior in time to the event of interest, such that events occurring during the window of interest should be collected;

identify, from the plurality of events, one or more events falling within the window of interest; and

queue the representation of each of the one or more events falling within the window of interest for transmission to a monitoring computer.

5. A system as recited by claim 4, wherein queuing the representation of the event of interest for transmission comprises storing the representation of the event of interest in an event queue.

6. A system as recited by claim 4, wherein the set of instructions is further operable, when executed by the processor, to transmit at least a portion of the representation of the identified event for reception by the monitoring computer.

7. A system as recited by claim 6, wherein the representation of the event of interest comprises a copy of the event of interest and a hash value generated from the event of interest.

8. A system as recited by claim 7, wherein transmitting at least a portion of the representation of the event of interest comprises transmitting only the hash value generated from the event.

9. A system as recited by claim 8, wherein the set of instructions is further operable, when executed by the processor, to:

receive from the monitoring computer a notification that the monitoring computer does not recognize the hash value as corresponding to any event identified by the monitoring computer; and

transmit the copy of the event to the monitoring computer, in response to the notification.

10. A system as recited by claim 6, wherein the monitored computer is not in communication with the monitoring computer during the monitoring of the plurality of events, and wherein queuing the representation of the event of interest for transmission to a monitoring computer comprises marking the representation of the event in the event cache for later transmission to the monitoring computer.

11. A system as recited by claim 4, wherein storing a representation of each of the plurality of events comprises:

recording at least one of the plurality of events; and

storing the at least one recorded event.

12. A system as recited by claim 4, wherein the identifier generated for each of the plurality of events comprises a hash value generated for each of the plurality of events.

13. A system as recited by claim 4, the set of instructions further operable to:

for each of the plurality of events, store the copy of the event and the generated identifier as the representation of the event if an existing identifier matching the generated identifier is not found in the search of the event cache.

14. A system as recited by claim 4, wherein the identifier comprises a timestamp.

15. A system as recited by claim 4, wherein the identifier comprises information sufficient to identify the monitored computer from among a plurality of computers.

16. A system as recited by claim 4, wherein the identifier comprises information about an application associated with the event.

17. A system as recited by claim 4, wherein the identifier comprises information about a session associated with the event.

18. A system as recited by claim 4, wherein the identifier comprises information about an event collection associated with the event.

19. A system as recited by claim 4, wherein the identifier comprises information sufficient to establish a chain of evidence regarding the event, such that the identifier allows identification of a time of the event and the monitored computer on which the event occurred.

20. A system as recited by claim 4, wherein the one or more rules comprises one or more rules identifying a list of events that are relatively more likely be collected.

21. A system as recited by claim 4, wherein the one or more rules comprises one or more rules identifying a set of keywords, such that an event having content that matches one of the set of keywords is relatively more likely be collected.

22. A system as recited by claim 4, wherein the one or more rules comprises one or more rules specifying one or more regular expressions, such that an event having content that satisfies one of the one or more regular expressions is relatively more likely be collected.

23. A system as recited by claim 4, wherein the one or more rules defines a window of time, such that events occurring within the window of time is relatively more likely to be collected or events occurring outside the window of time is relatively more likely be collected.

24. A system as recited by claim 4, wherein the at least one score is a plurality of scores, and wherein the plurality of scores are assigned by analyzing the event against a plurality of rules defining characteristics of events that should be collected.

25. A system as recited by claim 24, wherein comparing the at least one score with one or more thresholds comprises:

calculating a composite score from the plurality of scores; and

comparing the composite score with the one or more thresholds.

26. A system as recited by claim 24, wherein comparing the at least one score with one or more thresholds comprises comparing each of the plurality of scores with one or more thresholds, and wherein determining whether the event should be collected comprises determining, based on the comparison of the plurality of scores with the one or more thresholds, whether the event should be collected.

27. A system as recited by claim 4, wherein the plurality of events comprises a set of events comprising a first event and a second event, and wherein analyzing each of the plurality of events comprises:

performing an analysis the first event against one or more rules defining characteristics of events that should be collected;

performing an analysis of the second event against one or more rules defining characteristics of events that should be collected;

based on the analysis of the first event and the second event, assigning at least one score to one or more of the events in the set of events;

comparing the at least one score with one or more thresholds; and

based on a comparison of the at least one assigned score with the one or more thresholds, determining whether one or more of the events in the set of events should be collected.

28. A system as recited by claim 27, wherein one of the events in the set of events is a communication between the monitored computer and another computer via a first application program, and wherein another of the events in the set of events is a communication involving the monitored computer via a second application program.

29. A system as recited by claim 27, wherein one of the events in the set of events is a communication between the monitored computer and another computer, and wherein another of the events in the set of events in an event other than a communication between the monitored computer and another computer.

30. A system as recited by claim 4, the set of instructions further comprises:

instructions to associate the one or more events with the event of interest.

31. A system as recited by claim 4, wherein identifying an event comprises:

identifying a set of text associated with the event; and

comparing the set of text with at least one keyword.

32. A system as recited by claim 31, wherein comparing the set of text with at least one keyword comprises:

receiving at the monitored computer a regular expression that is satisfied by the keyword and a package comprising the at least one keyword and a set of at least one hash value generated from the keyword;

evaluating the set of text against the regular expression to determine whether at least a portion of the set of text satisfies the regular expression;

based on an evaluation of the set of text against the regular expression, generate a text hash from the at least a portion of the set of text;

compare the text hash to the at least one hash value;

based on a comparison of the text hash with the at least one hash value, identify the event as an event requiring monitoring.

33. The system of claim 4, wherein assigning at least one score to the plurality of events comprises:

determining content of the plurality of events that should be scored; and

creating a numeric score for the content that is determined should be scored.

34. A method of monitoring events on a monitored computer, the method comprising:

monitoring, with a software agent on the monitored computer, a plurality of events occurring on the monitored computer;

for each of the monitored events;

a) generating a hash value corresponding to the monitored event;

b) searching an event cache for an existing hash value matching the generated hash value;

c) if an existing hash value matching the generated hash value is found in the event cache, storing the generating hash value in the event cache as a representation of the monitored event;

d) if no existing hash value matching the generated hash value is found in the event cache, storing a copy of the monitored event, along with the generated hash value, in the event cache as a representation of the monitored event;

identifying one of the plurality of events as an event of interest, the identifying comprising;

analyzing each of the plurality of events against one or more rules defining characteristics of events that should be collected;

assigning at least one score to the plurality of events based on the analysis of the plurality of events;

comparing the at least one score assigned to the plurality of events with one or more thresholds; and

identifying one of the plurality of events on the monitored computer as the event of interest based on the comparison;

determining a window of interest prior in time to the event of interest, such that events falling within the window of interest should be collected;

identifying, from the plurality of events, one or more events falling within the window of interest; and

queuing the representation of the event of interest and the one or more events falling within the window of interest for transmission to a monitoring computer.

35. The method recited by claim 34, wherein the software agent is configured such that actions performed by the software event are not detectible by a user of the monitored computer.

36. The method of claim 34, wherein assigning at least one score to the plurality of events based on the analysis of the plurality of events comprises:

determining content of the plurality of events that should be scored; and

creating a numeric score for the content that is determined should be scored.

37. One or more computer-readable non-transitory storage media embodying software this is operable when executed by one or more computer systems to:

monitor a plurality of events occurring on the computer;

for each of the plurality of events;

generate an identifier corresponding to the event;

search an event cache for an existing identifier matching the generated identifier;

store a copy of the event as a representation of the event if an existing identifier matching the generated identifier is not found in the search of the event cache; and

store the generated identifier as the representation of the event if an existing identifier matching the generated identifier for the event is found in the search of the event cache;

analyze each of the plurality of events against one or more rules defining characteristics of events that should be collected and, based on the analysis of the plurality of events, assign at least one score to the plurality of events;

compare the at least one score assigned to the plurality of events with one or more thresholds, and, based on the comparison, identify one of the plurality of events on the computer as an event of interest;

determine that a set of one or more events occurring prior in time to the event of interest should be collected;

specify a window of interest prior in time to the event of interest, such that events occurring during the window of interest should be collected;

identify, from the plurality of events, one or more events falling within the window of interest; and

queue, for transmission to a second computer, the representations of the event of interest and each of the one or more events falling within the window of interest.

38. The computer software program recited by claim 37, wherein the computer software program is configured not to be detectible by a user of the computer.

39. The computer software program of claim 37, wherein assigning at least one score to the plurality of events comprises:

determining content of the plurality of events that should be scored; and

creating a numeric score for the content that is determined should be scored.