# US 10,482,251 B1 · Using integrity reports to detect network instrusion > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,251 B1 - Document ID: US10482251B1 - Status: Granted - Kind: B1 - Application number: 16/224,545 - Filed: 2018-12-18 - Granted: 2019-11-19 - Earliest claimed: 2015-08-26 - Assignees: Christopher Luis Hamlin - Applicants: Christopher Luis Hamlin - Inventors: Christopher Luis Hamlin - Web page: https://patentgrep.com/patent/US10482251B1 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Technique and systems for detecting network intrusion are described. Each device in a plurality of devices in the network can generate an integrity report by: (1) measuring a first set of execution parameter values during an execution of a portion of a software image at the device, (2) comparing the first set of execution parameter values with a second set of execution parameter values associated with executing the portion of the software image at a secure instance of the device, and (3) generating the integrity report based on said comparing. Next, the integrity reports can be collected, and network intrusions can be detected based on the integrity reports by using statistical and pattern recognition techniques including but not limited to neural nets implementing crossover and backpropagation, and classifiers including but not limited to cluster analysis, correlation and regression, factor analysis. ## Claims ### Claim 1 A computer-implemented method for detecting intrusions in a network, comprising: collecting integrity reports from a plurality of devices in the network, wherein each device in the plurality of devices generates an integrity report by: measuring a first set of execution parameter values during an execution of a portion of a software image at the device, wherein the first set of execution parameter values represents a first sequence of execution states that the device passes through while executing the portion of the software image; comparing the first set of execution parameter values with a second set of execution parameter values associated with executing the portion of the software image at a secure instance of the device, wherein the second set of execution parameter values represents a second sequence of execution states that the secure instance of the device is expected to pass through while executing the portion of the software image; and generating the integrity report based on said comparing; and detecting, by using a computer, intrusions in the network based on the integrity reports. ### Claim 2 (depends on 1) The method of claim 1, wherein at least one execution parameter is a count of total cycles. ### Claim 3 (depends on 1) The method of claim 1, wherein at least one execution parameter is an absolute starting time. ### Claim 4 (depends on 1) The method of claim 1, wherein at least one execution parameter is an absolute ending time. ### Claim 5 (depends on 1) The method of claim 1, wherein at least one execution parameter is a parameter received from a Global Positioning System (GPS) module. ### Claim 6 (depends on 1) The method of claim 1, wherein at least one execution parameter is a count of instructions that were executed. ### Claim 7 A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method for detecting intrusions in a network, the method comprising: collecting integrity reports from a plurality of devices in the network, wherein each device in the plurality of devices generates an integrity report by: measuring a first set of execution parameter values during an execution of a portion of a software image at the device, wherein the first set of execution parameter values represents a first sequence of execution states that the device passes through while executing the portion of the software image; comparing the first set of execution parameter values with a second set of execution parameter values associated with executing the portion of the software image at a secure instance of the device, wherein the second set of execution parameter values represents a second sequence of execution states that the secure instance of the device is expected to pass through while executing the portion of the software image; and generating the integrity report based on said comparing; and detecting intrusions in the network based on the integrity reports. ### Claim 8 (depends on 7) The non-transitory computer-readable storage medium of claim 7, wherein at least one execution parameter is a count of total cycles. ### Claim 9 (depends on 7) The non-transitory computer-readable storage medium of claim 7, wherein at least one execution parameter is an absolute starting time. ### Claim 10 (depends on 7) The non-transitory computer-readable storage medium of claim 7, wherein at least one execution parameter is an absolute ending time. ### Claim 11 (depends on 7) The non-transitory computer-readable storage medium of claim 7, wherein at least one execution parameter is a parameter received from a Global Positioning System (GPS) module. ### Claim 12 (depends on 7) The non-transitory computer-readable storage medium of claim 7, wherein at least one execution parameter is a count of instructions that were executed. ### Claim 13 An apparatus, comprising: a processor; and a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the processor to perform a method for detecting intrusions in a network, the method comprising: collecting integrity reports from a plurality of devices in the network, wherein each device in the plurality of devices generates an integrity report by: measuring a first set of execution parameter values during an execution of a portion of a software image at the device, wherein the first set of execution parameter values represents a first sequence of execution states that the device passes through while executing the portion of the software image; comparing the first set of execution parameter values with a second set of execution parameter values associated with executing the portion of the software image at a secure instance of the device, wherein the second set of execution parameter values represents a second sequence of execution states that the secure instance of the device is expected to pass through while executing the portion of the software image; and generating the integrity report based on said comparing; and detecting intrusions in the network based on the integrity reports. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein at least one execution parameter is a count of total cycles. ### Claim 15 (depends on 13) The apparatus of claim 13, wherein at least one execution parameter is an absolute starting time. ### Claim 16 (depends on 13) The apparatus of claim 13, wherein at least one execution parameter is an absolute ending time. ### Claim 17 (depends on 13) The apparatus of claim 13, wherein at least one execution parameter is a parameter received from a Global Positioning System (GPS) module. ### Claim 18 (depends on 13) The apparatus of claim 13, wherein at least one execution parameter is a count of instructions that were executed.