Systems, methods, and media for defending computing systems from attack

A method for defending a computing system from attack, comprising:

• maintaining a round counter that tracks a round number for a local host using a hardware processor;
• determining a location in a graph for each of a plurality of hosts including the local host using the hardware processor, wherein the location in the graph for each of a plurality of hosts is determined using a pseudo-random function based on a shared key, the round counter, and an identifier for each of the plurality of hosts;
• determining monitor hosts of the plurality of hosts that are monitoring the local host using the hardware processor;
• determining monitoree hosts of the plurality of hosts that are being monitored by the local host using the hardware processor;
• sending a message to each of the monitor hosts identifying a value of the round counter using the hardware processor;
• forwarding a first set of heartbeat messages from previous monitoree hosts to the monitor hosts using the hardware processor;
• attempting to receive messages from the monitoree hosts using the hardware processor;
• determining whether any messages were not received from the monitoree hosts using the hardware processor;
• and
• in response to determining that one or more messages were not received from the monitoree hosts, generating an alert using the hardware processor.

A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for defending a computing system from attack, the method comprising:

• maintaining a round counter that tracks a round number for a local host;
• determining a location in a graph for each of a plurality of hosts including the local host, wherein the location in the graph for each of a plurality of hosts is determined using a pseudo-random function based on a shared key, the round counter, and an identifier for each of the plurality of hosts;
• determining monitor hosts of the plurality of hosts that are monitoring the local host;
• determining monitoree hosts of the plurality of hosts that are being monitored by the local host;
• sending a message to each of the monitor hosts identifying a value of the round counter;
• forwarding a first set of heartbeat messages from previous monitoree hosts to the monitor hosts;
• attempting to receive messages from the monitoree hosts;
• determining whether any messages were not received from the monitoree hosts;
• and
• in response to determining that one or more messages were not received from the monitoree hosts, generating an alert.