Systems and methods for creating a code inspection system

• US 7,010,698 B2
• Filed: 02/14/2002
• Issued: 03/07/2006
• Est. Priority Date: 02/14/2001
• Status: Active Grant

• Current Assignee: Invicta Networks, Inc.
• Original Assignee: Invicta Networks, Inc.
• Inventors: Sheymov, Victor I.
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US10/074,037
• Publication Number:
  US 20020116635A1
• Time in Patent Office: 1,482 Days
• Field of Search: 713/194, 713/200, 713/201
• US Class Current: 713/194
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors

Abstract

A code inspection system produces a dynamic decoy machine that closely parallels one or more protected systems. The code inspection system can analyze and monitor one or more protected systems, and as those protected systems are updated, altered or modified, the dynamic decoy machine, in which potentially malicious code is tested, can also be updated. Thus, the dynamic decoy machine can accurately reflect the current state of the one or more protected systems such that the potentially destructive nature, if any, of suspicious code can be evaluated as if it were in the actual environment of the protected system, without jeopardizing the security of the protected system.

Claims

1. A code inspection system comprising:

a code inspection management module that monitors and communicates with a protected system;

a dynamic decoy system that, in cooperation with the code inspection management module, is updated to substantially parallel relevant portions of the protected system;

an actuator module; and

one or more sensor modules, wherein the dynamic decoy system is capable of analyzing at least one of actions and results of one or more portions of code in response to stimuli from the actuator module,

wherein the relevant portions of the protected system allow the one or more portions of code to be analyzed in the dynamic decoy system as if the dynamic decoy system were the protected system.

2. The system of claim 1, wherein the actuator module at least one of executes the one or more portions of code, opens the one or more portions of code, inputs information to the one or more portions of code and simulates a passage of time longer than a period of testing.

3. The system of claim 1, wherein the one or more sensor modules detect one or more of unauthorized access attempts, unauthorized command execution attempts and unauthorized modifications to one or more portions of the dynamic decoy machine.

4. The system of claim 1, wherein the protected system is at least one of a computer, a plurality of computers, a network and one or more input devices.

5. The system of claim 1, wherein the dynamic decoy system can be incorporated into a portion of the protected system.

6. The system of claim 5, wherein at least a portion of the code inspection system is in at least one of a BIOS and an operating system of the protected system.

7. A code inspection system comprising:

a code inspection management module that monitors and communicates with a protected system;

a dynamic decoy system that, in cooperation with the code inspection management module, is updated to substantially parallel relevant portions of the protected system;

an actuator module; and

one or more sensor modules, wherein the dynamic decoy system is capable of analyzing at least one of actions and results of one or more portions of code in response to stimuli from the actuator module,

wherein at least a portion of the protected system is capable of being recovered from the dynamic decoy system.

8. A code inspection system comprising:

a code inspection management module that monitors and communicates with a protected system;

a dynamic decoy system that, in cooperation with the code inspection management module, is updated to substantially parallel relevant portions of the protected system;

an actuator module; and

one or more sensor modules, wherein the dynamic decoy system is capable of analyzing at least one of actions and results of one or more portions of code in response to stimuli from the actuator module,

wherein the code inspection system is an interface between the protected system and one or more unprotected systems.

9. A code inspection system comprising:

a code inspection management module that monitors and communicates with a protected system;

a dynamic decoy system that, in cooperation with the code inspection management module, is updated to substantially parallel relevant portions of the protected system;

an actuator module; and

one or more sensor modules, wherein the dynamic decoy system is capable of analyzing at least one of actions and results of one or more portions of code in response to stimuli from the actuator module,

wherein the code inspection management module monitors the protected system and updates the dynamic decoy system based on at least one of installed software, installed hardware, operating system upgrades, software upgrades, hardware upgrades, software deletions, hardware deletions and input/output devices.

10. A method of creating and maintaining a dynamic decoy system based on a protected system comprising:

creating a dynamic decoy system that substantially parallels relevant portions of a protected system;

updating the dynamic decoy system based on changes to the protected system;

receiving one or more portions of code;

introducing the one or more portions of code to the dynamic decoy system;

simulating operating conditions of the protected system in the dynamic decoy system; and

monitoring sensors in the dynamic decoy system for at least one of actions or results of the one or more portions of code,

wherein the relevant portions of the protected system allow the one or more portions of code to be analyzed in the dynamic decoy system as if the dynamic decoy system were the protected system.

11. The method of claim 10, further comprising forwarding approved code to the protected system.

12. The method of claim 10, further comprising restoring one or more portions of the protected system based on the dynamic decoy system.

13. The method of claim 10, further comprising at least one of deleting and removing at least one unauthorized portion the one or more portions of code.

14. A method of creating and maintaining a dynamic decoy system based on a protected system comprising:

creating a dynamic decoy system that substantially parallels relevant portions of a protected system;

updating the dynamic decoy system based on changes to the protected system;

receiving one or more portions of code;

introducing the one or more portions of code to the dynamic decoy system;

simulating operating conditions of the protected system in the dynamic decoy system; and

monitoring sensors in the dynamic decoy system for at least one of actions or results of the one or more portions of code,

wherein the dynamic decoy system is an interface between the protected system and one or more unprotected systems.

15. A method of creating and maintaining a dynamic decoy system based on a protected system comprising:

creating a dynamic decoy system that substantially parallels relevant portions of a protected system;

updating the dynamic decoy system based on changes to the protected system;

receiving one or more portions of code;

introducing the one or more portions of code to the dynamic decoy system;

simulating operating conditions of the protected system in the dynamic decoy system;

monitoring sensors in the dynamic decoy system for at least one of actions or results of the one or more portions of code; and

installing one or more sensors in the dynamic decoy system that detect one or more of unauthorized access attempts, unauthorized command execution attempts and unauthorized modifications to one or more portions of the dynamic decoy machine.

16. A method of creating and maintaining a dynamic decoy system based on a protected system comprising:

creating a dynamic decoy system that substantially parallels relevant portions of a protected system;

updating the dynamic decoy system based on changes to the protected system;

receiving one or more portions of code;

introducing the one or more portions of code to the dynamic decoy system;

simulating operating conditions of the protected system in the dynamic decoy system;

monitoring sensors in the dynamic decoy system for at least one of actions or results of the one or more portions of code; and

installing an actuator in the dynamic decoy system.

17. The method of claim 16, wherein the actuator at least one of executes the one or more portions of code, opens the one or more portions of code, inputs information to the one or more portions of code and simulates a passage of time longer than a period of testing.

18. A method of creating and maintaining a dynamic decoy system based on a protected system comprising:

creating a dynamic decoy system that substantially parallels relevant portions of a protected system;

updating the dynamic decoy system based on changes to the protected system;

receiving one or more portions of code;

introducing the one or more portions of code to the dynamic decoy system;

simulating operating conditions of the protected system in the dynamic decoy system; and

monitoring sensors in the dynamic decoy system for at least one of actions or results of the one or more portions of code,

wherein updating the dynamic decoy system is based on at least one of installed software, installed hardware, operating system upgrades, software upgrades, hardware upgrades, software deletions, hardware deletions and input/output devices.

19. An information storage media comprising information that creates and maintains a dynamic decoy system based on a protected system comprising:

information that creates a dynamic decoy system that substantially parallels relevant portions of a protected system;

information that updates the dynamic decoy system based on changes to the protected system;

information that receives one or more portions of code;

information that introduces the one or more portions of code to the dynamic decoy system;

information that simulates operating conditions of the protected system in the dynamic decoy system; and

information that monitors sensors in the dynamic decoy system for at least one of actions or results of the one or more portions of code,

wherein the relevant portions of the protected system allow the one or more portions of code to be analyzed in the dynamic decoy system as if the dynamic decoy system were the protected system.

20. The media of claim 19, further comprising information that forwards approved code to the protected system.

21. The media of claim 19, further comprising information that restores one or more portions of the protected system based on the dynamic decoy system.

22. The media of claim 19, further comprising information that at least one of deletes and removes at least one unauthorized portion of the one or more portions of code.

23. An information storage media comprising information that creates and maintains a dynamic decoy system based on a protected system comprising:

information that creates a dynamic decoy system that substantially parallels relevant portions of a protected system;

information that updates the dynamic decoy system based on changes to the protected system;

information that receives one or more portions of code;

information that introduces the one or more portions of code to the dynamic decoy system;

information that simulates operating conditions of the protected system in the dynamic decoy system; and

information that monitors sensors in the dynamic decoy system for at least one of actions or results of the one or more portions of code,

wherein the dynamic decoy system is an interface between the protected system and one or more unprotected systems.

24. An information storage media comprising information that creates and maintains a dynamic decoy system based on a protected system comprising:

information that creates a dynamic decoy system that substantially parallels relevant portions of a protected system;

information that updates the dynamic decoy system based on changes to the protected system;

information that receives one or more portions of code;

information that introduces the one or more portions of code to the dynamic decoy system;

information that simulates operating conditions of the protected system in the dynamic decoy system;

information that monitors sensors in the dynamic decoy system for at least one of actions or results of the one or more portions of code; and

information that installs one or more sensors in the dynamic decoy system that detect one or more of unauthorized access attempts, unauthorized command execution attempts and unauthorized modifications to one or more portions of the dynamic decoy machine.

25. An information storage media comprising information that creates and maintains a dynamic decoy system based on a protected system comprising:

information that creates a dynamic decoy system that substantially parallels relevant portions of a protected system;

information that updates the dynamic decoy system based on changes to the protected system;

information that receives one or more portions of code;

information that introduces the one or more portions of code to the dynamic decoy system;

information that simulates operating conditions of the protected system in the dynamic decoy system;

information that monitors sensors in the dynamic decoy system for at least one of actions or results of the one or more portions of code; and

information that installs an actuator in the dynamic decoy system.

26. The media of claim 25, wherein the actuator at least one of executes the one or more portions of code, opens the one or more portions of code, inputs information to the one or more portions of code and simulates a passage of time longer than a period of testing.

27. An information storage media comprising information that creates and maintains a dynamic decoy system based on a protected system comprising:

information that creates a dynamic decoy system that substantially parallels relevant portions of a protected system;

information that updates the dynamic decoy system based on changes to the protected system;

information that receives one or more portions of code;

information that introduces the one or more portions of code to the dynamic decoy system;

information that simulates operating conditions of the protected system in the dynamic decoy system; and

information that monitors sensors in the dynamic decoy system for at least one of actions or results of the one or more portions of code,

wherein updating the dynamic decoy system is based on at least one of installed software, installed hardware, operating system upgrades, software upgrades, hardware upgrades, software deletions, hardware deletions and input/output devices.