Information security analysis system

• US 6,253,337 B1
• Filed: 07/19/1999
• Issued: 06/26/2001
• Est. Priority Date: 07/21/1998
• Status: Expired due to Term

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Suit, John M., Scott, Christopher J., Woodus, Francis M., Maloney, Michael P.
• Primary Examiner(s): Beausoleil, Robert
• Assistant Examiner(s): BADERMAN, SCOTT T
• Application Number:
  US09/357,539
• Time in Patent Office: 708 Days
• Field of Search: 714/38, 714/57, 714/46, 714/47, 714/48, 714/26, 713/201, 713/188, 717/4
• US Class Current: 714/38.14
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The analysis system is a collection, configuration and integration of software programs that reside on multiple interconnected computer platforms. The software, less computer operating systems, is a combination of sensor, analysis, data conversion, and visualization programs. The hardware platforms consist of several different types of interconnected computers, which share the software programs, data files, and visualization programs via a Local Area Network (LAN). This collection and integration of software and the migration to a single computer platform results in an approach to LAN/WAN monitoring in either a passive and/or active mode. The architecture permits digital data input from external sensors for analysis, display and correlation with data and displays derived from four major software concept groups. These are: Virus Computer Code Detection; Analysis of Computer Source and Executable Code; Dynamic Monitoring of Data Communication Networks; 3-D Visualization and Animation of Data.

Claims

1. A method for templating and viewing virus computer code for data communications networks, comprising:

gathering from a host computer information on a bit stream of computer code prior to execution by the host computer;

generating a knowledge base of the bit stream of the computer code gathered from the host computer;

parsing the information in the knowledge base to generate data into structured files having a readable format;

analyzing the data in the structured files to derive a genetic structure and examine the functionality of suspect computer code;

comparing a plurality of genetic structures to determine the presence of a computer virus; and

visualizing the structured files to display in a user interactive graphical functional mode functionality of suspect computer code to identify the presence of a computer virus prior to execution in the host computer.

2. The method for templating and viewing a virus computer code as set forth in claim 1 wherein analyzing the data comprises determining internal and external intrusion attempts.

3. The method for templating and viewing a virus computer code as set forth in claim 1 wherein comparing a plurality of genetics structures comprises determining when the derived genetic structure resides in the suspect computer code to determine the presence of a computer virus.

4. The method for templating and viewing a virus computer code as set forth in claim 1 wherein analyzing the data comprises documenting and organizing the computer code in a functional relationship.

5. The method for templating and viewing a virus computer code as set forth in claim 1 wherein gathering information comprises passively collecting information on the bit stream of the computer code.

6. The method for templating and viewing a virus computer code as set forth in claim 1 wherein analyzing the data comprises analyzing attachments to an E-mail message.

7. The method for templating and viewing a virus computer code as set forth in claim 1, wherein comparing a plurality of genetic structures comprises determining the degree of functional alteration.

8. A method for templating and viewing virus computer code for data communications networks, comprising:

gathering from a host computer information on a bit stream of computer code prior to execution by the host computer;

generating a knowledge base of the bit stream of the computer code gathered from the host computer;

parsing the information in the knowledge base to generate data into structured files having a readable format;

analyzing the data in the structured files to derive a genetic structure and examine the functionality of suspect computer code;

comparing a plurality of genetic structures to determine the presence of a computer virus; and

displaying in a user interactive graphical functional mode the structured files to identify the presence of a computer virus prior to execution in the host computer.

9. The method for templating and viewing a virus computer code as set forth in claim 8 wherein comparing a plurality of genetic structures comprises determining when the derived genetic structure resides in the suspect computer code to determine the presence of a computer virus.

10. The method for templating and viewing a virus computer code as set forth in claim 8 wherein analyzing the data comprises documenting and organizing the computer code in a functional relationship.

11. The method for templating and viewing a virus computer code as set forth in claim 8 wherein gathering information comprises passively collecting information on the bit stream of the computer code.

12. The method for templating and viewing a virus computer code as set forth in claim 8 wherein analyzing the data comprises analyzing attachments to an E-mail message.

13. The method for templating and viewing a virus computer code as set forth in claim 8, wherein comparing a plurality of genetic structures comprises determining the degree of functional alteration.

14. A method for templating and viewing virus computer code for data communications networks, comprising:

gathering from a host computer information on a bit stream of computer code prior to execution by the host computer;

generating a knowledge base of the bit stream of the computer code gathered from the host computer;

analyzing the data in the knowledge base to derive a genetic structure and examine the functionality of suspect computer code;

comparing a plurality of genetic structures to determine the presence of a computer virus; and

visualizing the analyzed data to display in a user interactive graphical functional mode functionality of suspect computer code to identify the presence of a computer virus prior to execution in the host computer.

15. The method for templating and viewing a virus computer code as set forth in claim 14 further comprising functionally interconnecting an operator software interface to the gathering of information, generating a knowledge base of the operator software, and analyzing the data to receive instructions from an operator.

16. The method for templating and viewing a virus computer code as set forth in claim 15 further comprising formatting the analyzed data in accordance with user instructions for visualization to identify the presence of a computer virus.

17. The method for templating and viewing a virus computer code as set forth in claim 14, wherein comparing a plurality of genetic structures comprises determining the degree of functional alteration.

18. A method for templating and viewing virus computer code for data communications networks, comprising:

generating a knowledge base of a bit stream of a computer code;

parsing the information in the knowledge base to generate data into structured files having a readable format;

analyzing the data in the structured files to derive a genetic structure of suspect computer code to determine the presence of a computer virus;

displaying in a graphical functional mode the analyzed data to determine the presence of a computer virus prior to execution in a host computer; and

rotating the analyzed data on an axis on two or more separate but connected visual planes.

19. A method for templating and viewing virus computer code for data communications networks, comprising:

generating a knowledge base of a bit stream of a computer code;

parsing the information in the knowledge base to generate data into structured files having a readable format;

analyzing the data in the structured files to derive a genetic structure of suspect computer code to determine the presence of a computer virus;

displaying in a graphical functional mode the analyzed data to determine the presence of a computer virus prior to execution in a host computer; and

appending user definable symbols for enhancing an understanding by an operator or analyst.

20. A method for templating and viewing virus computer code for data communications networks comprising a plurality of nodes, comprising:

generating a knowledge base of a bit stream of a computer code;

parsing the information in the knowledge base to generate data into structured files having a readable format;

contracting several nodes of a data communications network into a single interconnecting common node for analysis to determine the presence of a computer virus

analyzing the data in the structured files to derive a genetic structure of suspect computer code to determine the presence of a computer virus; and

displaying in a graphical functional mode the analyzed data to determine the presence of a computer virus prior to execution in a host computer.