System and method for detecting peer-to-peer network software

• US 9,178,940 B2
• Filed: 04/12/2005
• Issued: 11/03/2015
• Est. Priority Date: 04/12/2005
• Status: Active Grant

• Current Assignee: Kroll Information Assurance LLC
• Original Assignee: Tiversa Ip, Inc.
• Inventors: Hopkins, Samuel P.
• Primary Examiner(s): BROPHY, MATTHEW J
• Application Number:
  US11/103,818
• Publication Number:
  US 20060248525A1
• Time in Patent Office: 3,857 Days
• Field of Search: 709223-226, 726 22- 23, 717/174
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1068 Discovery involving direct consultation or announcement among potential requesting and potential source peers

Abstract

The present invention provides a method for detecting whether or not a computer system is, has, or can participate in a Peer-to-Peer network. Scanning software is executed on a target system to be scanned or a remote system which will scan a target system. If Peer-to-Peer client software is detected the scanning software can notify the enforcing user, disable the Peer-to-Peer client software, or both.

Claims

1. A system for detecting peer-to-peer network software, said system comprising:

a. a storage medium for storing instructions;

b. a user input device for receiving user input; and

c. a processor unit operable to process said user input and to use said instructions to execute a scanning program to;

i. review a first feature of a target computer indicative of installation of peer-to- peer client software on the target computer, wherein said first feature is selected from a group consisting of said target computer'"'"'s registry keys, registry values, installed executable files, disk directories and network communications;

ii. compare said first feature of said target computer to first known information indicative of installation of the peer-to-peer client software on the target computer;

iii. review a second feature of said target computer indicative of past participation in peer-to-peer network communication by the peer-to-peer client software on said target computer, said second feature consisting of determining if multimedia files are stored locally on said target computer;

iv. compare said second feature of said target computer to second known information including at least a predetermined threshold count of multimedia files wherein a search is initiated on an entirety of local storage of said target computer for the multimedia files and the search is stopped when the predetermined threshold count of multimedia files is reached, the predetermined threshold count of multimedia files being indicative of the past participation by the peer-to-peer client software in the peer-to-peer network communication;

v. determine that the peer-to-peer client software has been installed on said target computer and that files are being shared by the target computer in the peer-to-peer network communication in response to the compare of said first feature matching the first known information indicative of installation of the peer-to-peer client software on the target computer and the compare of said second feature being greater than or equal to the second known information including at least the predetermined threshold count of multimedia files;

vi. in response to the determination that the peer-to-peer client software has been installed on said target computer and that files are being shared by the target computer in the peer-to-peer network communication, disable the peer-to-peer client software and notify a network administrator of result of the comparisons; and

vii. determine that the peer-to-peer client software has not been installed on said target computer and that files are not being shared by the target computer in the peer-to-peer network communication in response to the compare of said first feature not matching the first known information indicative of installation of the peer-to-peer client software on the target computer and the compare of said second feature being less than the second known information including the at least the predetermined threshold count of multimedia files.

2. The system as set forth in claim 1 wherein said first feature further comprises executing the scanning program to:

i. connect to a TCP/IP port of the target computer TCP/IP port;

ii. establish a successful connection with said target computer;

and said compare of said first feature further comprises executing the scanning program to;

iii. compare a TCP/IP port number to a known value; and

iv. determine that the peer-to-peer client software has been installed on said target computer based on the TCP/IP port number matching the known value.

3. The system as set forth in claim 1 wherein said files or directories are available over a private network and said scanning program is executed on a computer system separate from said target computer.

4. The system as set forth in claim 1 wherein said multimedia files are music based.

5. The system as set forth in claim 1 wherein said multimedia files are movie based.

6. The system as set forth in claim 1 wherein said multimedia files are ebook based.

7. The system as set forth in claim 1 wherein said first feature is a registry key indicative of installation of the peer-to-peer software.

8. The system as set forth in claim 1 wherein said first feature is a file directory.

9. The system as set forth in claim 1 wherein said first feature is a running process that corresponds to installation of the peer-to-peer client software.

10. The system as set forth in claim 1 wherein said first feature is a code known to be included in peer-to-peer protocol messages exchanged between said target computer and other computers connected to a peer-to-peer network.

11. The system as set forth in claim 1 wherein determining if the multimedia files are stored locally on said target computer further comprises searching all folder and directories on the entirety of the local storage of the target computer for the multimedia files.

12. A method comprising:

reviewing, by a processor of a computer, a first feature of a target computer indicative of installation of peer-to- peer client software on the target computer, wherein said first feature is selected from a group consisting of said target computer'"'"'s registry keys, registry values, installed executable files, disk directories and network communications;

comparing said first feature of said target computer to first known information indicative of installation of the peer-to-peer client software on the target computer;

reviewing a second feature of said target computer indicative of past participation in peer-to-peer network communication by the peer-to-peer client software on said target computer, said second feature consisting of determining if multimedia files are stored locally on an entirety of local storage of said target computer;

comparing said second feature of said target computer to second known information including at least a predetermined threshold count of multimedia files wherein a search is initiated on the entirety of local storage of said target computer for the multimedia files and the search is stopped when the predetermined threshold count of multimedia files is reached, the predetermined threshold count of multimedia files being indicative of the past participation by the peer-to-peer client software in the peer-to-peer network communication;

determining that the peer-to-peer client software has been installed on said target computer and that files are being shared by the target computer in the peer-to-peer network communication in response to the compare of said first feature matching the first known information indicative of installation of the peer-to-peer client software on the target computer and the compare of said second feature being greater than or equal to the second known information including the at least the predetermined threshold count of multimedia files;

in response to the determination that the peer-to-peer client software has been installed on said target computer and that files are being shared by the target computer in the peer-to-peer network communication, disabling the peer-to-peer client software and notify a network administrator of result of the comparisons; and

determining that the peer-to-peer client software has not been installed on said target computer and that files are not being shared by the target computer in the peer-to-peer network communication in response to the compare of said first feature not matching the first known information indicative of installation of the peer-to-peer client software on the target computer and the compare of said second feature being less than the second known information including the at least the predetermined threshold count of multimedia files.

13. The method as set forth in claim 12 wherein said multimedia files are music based.

14. The method as set forth in claim 12 wherein said multimedia files are movie based.

15. The method as set forth in claim 12 wherein said multimedia files are ebook based.

16. The method as set forth in claim 12 further comprising:

connecting to a TCP/IP port of the target computer;

comparing a TCP/IP port number of the TCP/IP port to a known value; and

determining that the peer-to-peer client software has been installed on the target computer in response to the TCP/IP port number matching the known value.

17. The method as set forth in claim 12 wherein said first feature is a registry key indicative of installation of the peer-to-peer client software.

18. The method as set forth in claim 12 wherein said first feature is a file directory.

19. The method as set forth in claim 12 wherein said first feature is a running process that corresponds to installation of the peer-to-peer client software.

20. A non-transitory computer-readable storage medium containing executable program instructions executed by a processor, comprising:

program instructions that receive a first feature of a target computer indicative of installation of peer-to-peer client software on the target computer, wherein said first feature is selected from a group consisting of said target computer'"'"'s registry keys, registry values, installed executable files, disk directories and network communications;

program instructions that compare said first feature of said target computer to first known information indicative of installation of the peer-to-peer client software on the target computer;

program instructions that review a second feature of said target computer indicative of past participation in peer-to-peer network communication by the peer-to-peer client software on said target computer, said second feature consisting of determining if multimedia files are stored locally on an entirety of local storage of said target computer;

program instructions that compare said second feature of said target computer to second known information including at least a predetermined threshold count of multimedia files wherein a search is initiated on the entirety of local storage of said target computer for the multimedia files and the search is stopped when the predetermined threshold count of multimedia files is reached, the predetermined threshold count of multimedia files being indicative of the past participation by the peer-to-peer client software in the peer-to-peer network communication;

program instructions that determine that the peer-to-peer client software has been installed on said target computer and that files are being shared by the target computer in peer-to-peer network communication in response to the compare of said first feature matching the first known information indicative of installation of the peer-to-peer client software on the target computer and the compare of said second feature being greater than or equal to the second known information including the at least the predetermined threshold count of multimedia files;

program instructions that disable the peer-to-peer network client software and notify a network administrator of result of the comparisons, in response to the determination that the peer-to-peer client software has been installed on said target computer and that files are being shared by the target computer in the peer-to-peer network communication; and

program instructions that determine that the peer-to-peer client software has not been installed on said target computer and that files are not being shared by the target computer in the peer-to-peer network communication in response to the compare of said first feature not matching the first known information indicative of installation of the peer-to-peer client software on the target computer and the compare of said second feature being less than the second known information including the at least the predetermined threshold count of multimedia files.