PROTECTION OF COMPUTER RESOURCES

• US 20110023084A1
• Filed: 09/30/2010
• Published: 01/27/2011
• Est. Priority Date: 10/11/2006
• Status: Active Grant

• Current Assignee: Jeffrey A. Kraemer
• Original Assignee: Jeffrey A. Kraemer
• Inventors: KRAEMER, Jeffrey A.
• Granted Patent: US 8,225,373 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In one embodiment, local software code present in a computer system enables real-time detection of whether the computer system is properly protected against malicious attacks from harmful software. For example, software code such as one or more agents executing in the computer system support real-time protection validation based upon detection of the behavior of the computer system (as opposed to mere detection of the presence of resources or applications in the computer system). In response to detecting that the computer system or an application accesses or provides a particular type of resource and should be protected via one or more appropriate protection policies, if the computer system is not already protected, an agent of the computer system can provide immediate remediation (e.g., a security measure) to temporarily protect the computer system until the appropriate protection policy can be activated to protect the computer system against malicious software threats.

Claims

1. A non-transitory computer-readable medium carrying one or more sequences of instructions for providing security to a computer system, which instructions, when executed by one or more processors, cause the one or more processors to perform:

monitoring occurrence of events associated with the computer system;

in response to detecting occurrence of a given event in the computer system, initiating execution of an audit rule associated with the given event to provide notification that a corresponding protection policy associated with the given event should be currently operating to protect the computer system;

evaluating whether the corresponding protection policy is currently operating in the computer system;

in response to identifying that the corresponding protection policy should be but is not currently operating in the computer system, initiating application of a security measure to protect the computer system;

wherein the monitoring includes initiating execution of an audit policy and a corresponding set of rules in the computer system that, when executed in the computer system, selectively provide notification of which of multiple types of protection policies should be currently activated in the computer system to protect the computer system against known computer attacking software in response to detecting activities in the computer system that are indicative of the known computer attacking software.

2. The non-transitory computer-readable medium as in claim 1, further comprising instructions for performing:

accessing a repository of information to identify whether the corresponding protection policy, if currently operating to protect the computer system, has initiated execution of a rule that modifies contents of the repository to provide notification that the corresponding protection policy is currently operating to protect the computer system.

3. The non-transitory computer-readable medium as in claim 1, further comprising instructions for performing initiating activation of the corresponding protection policy, if not already activated, to protect the computer system against a set of harmful events known to inhibit proper operation of the computer system.

4. The non-transitory computer-readable medium as in claim 1 further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform:

initiating execution of a first type of protection policy to protect the computer system against a respective set of computer attacking software known to attack a first type of computer functionality associated with the computer system;

initiating execution of a second type of protection policy to protect the computer system against a respective set of computer attacking software known to attack a second type of computer functionality associated with the computer system;

wherein initiating application of the security measure to protect the computer system includes initiating execution of a third type of protection policy to protect the computer system against a respective set of computer attacking software known to attack a third type of computer functionality associated with the computer system.

5. The non-transitory computer-readable medium as in claim 1, further comprising instructions for performing monitoring respective actions associated with the computer system.

6. The non-transitory computer-readable medium as in claim 1, further comprising instructions for performing monitoring access to respective resources associated with the computer system.

7. The non-transitory computer-readable medium as in claim 1, further comprising instructions for performing automatically implementing a containment policy to limit further activities related to the given event.

8. The non-transitory computer-readable medium as in claim 1, further comprising instructions for performing automatically implementing a containment policy that, when executed, prevents the computer system from executing potentially malicious software in connection with the given event.

9. The non-transitory computer-readable medium as in claim 1, further comprising instructions for performing initiating transmission of a signal over a respective network connection to notify a central management console that the computer system is not protected against executing potentially malicious software in connection with the given event.

10. The non-transitory computer-readable medium as in claim 9 further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform:

receiving a response over the network from the central management console to implement the corresponding protection policy at the computer system to protect the computer system against malicious computer software known to corrupt at least certain functionality associated with the computer system.

11. The non-transitory computer-readable medium as in claim 1, further comprising instructions to cause the initiating operation of the audit rule to i) occur in response to detecting pre-defined behavior associated with the computer system and ii) result in setting a flag indicating a resource type associated with the given event that should be protected in the computer system.

12. The non-transitory computer-readable medium as in claim 11 further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform:

after evaluating whether the corresponding protection policy is currently operating in the computer system to protect the resource type associated with the given event, resetting the flag;

repeating said setting the flag, evaluating a current protection policy implemented in the computer system, and resetting the flag for future detected events to ensure real-time protection of resources in the computer system.

13. A non-transitory computer-readable medium carrying one or more sequences of instructions, which, when executed by one or more processors, cause the one or more processors to perform:

based on a real-time detection of specific behavior in a computer system that should be protected against a possible presence of known computer attacking software, initiate execution of an audit policy rule that, when executed in the computer system, provides notification that a particular type of protection policy of multiple types of protection policies should be currently activated in the computer system to protect the computer system;

accessing a repository of information to identify and evaluate whether the particular protection policy is currently protecting the computer system;

in response to identifying that the corresponding protection policy should be but is not currently protecting the computer system, automatically implementing a security measure that, when executed, at least temporarily limits further activities associated with the computer system to protect the computer system from the known computer attacking software.

14. The non-transitory computer-readable medium as in claim 13 further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform:

initiating transmission of a signal over a respective network connection to notify a central management console that the behavior associated with the computer system warrants that the computer system be protected against the possible presence of the known computer attacking software.

15. The non-transitory computer-readable medium as in claim 13 further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform:

receiving a response over a network from a protection policy management source to implement the particular type of protection policy in the computer system to protect the computer system against the known computer attacking software.