Using integrity reports to detect network instrusion

A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method for detecting intrusions in a network, the method comprising:

• collecting integrity reports from a plurality of devices in the network, wherein each device in the plurality of devices generates an integrity report by:
• measuring a first set of execution parameter values during an execution of a portion of a software image at the device, wherein the first set of execution parameter values represents a first sequence of execution states that the device passes through while executing the portion of the software image;
• comparing the first set of execution parameter values with a second set of execution parameter values associated with executing the portion of the software image at a secure instance of the device, wherein the second set of execution parameter values represents a second sequence of execution states that the secure instance of the device is expected to pass through while executing the portion of the software image;
• and
• generating the integrity report based on said comparing;
• and
• detecting intrusions in the network based on the integrity reports.

An apparatus, comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the processor to perform a method for detecting intrusions in a network, the method comprising:
• collecting integrity reports from a plurality of devices in the network, wherein each device in the plurality of devices generates an integrity report by:
• measuring a first set of execution parameter values during an execution of a portion of a software image at the device, wherein the first set of execution parameter values represents a first sequence of execution states that the device passes through while executing the portion of the software image;
• comparing the first set of execution parameter values with a second set of execution parameter values associated with executing the portion of the software image at a secure instance of the device, wherein the second set of execution parameter values represents a second sequence of execution states that the secure instance of the device is expected to pass through while executing the portion of the software image;
• and
• generating the integrity report based on said comparing;
• and
• detecting intrusions in the network based on the integrity reports.