Back to results
US 11,775,639 B2Granted
File integrity monitoring
AssigneeSophos Limited
InventorsNicholas James Collier, Nikolay Ivanov Nikolaev, Chloe Acebes
Life of this patent
Estimating the term…
Abstract
A file integrity monitoring system supports monitoring of system-critical, enterprise-critical and user-critical data by reporting events to a threat management facility in response to changes in certain files, folders, registry keys and registry values of the computing environment in which the system is operating and/or monitoring. The file integrity monitoring system may dynamically create, adapt and apply context-based rules to improve the sensitivity and relevance of reported events to undesirable changes in the data footprint of a monitored device.
Claims20
A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
- instrumenting a compute instance with a file integrity monitor, the file integrity monitor configured with a number of rules to detect interactions with files on the compute instance;
- creating a first set of rules in the number of rules for the file integrity monitor to detect changes in the files based on an operating system for the compute instance, wherein the first set of rules is created automatically based on a detection of the operating system for the compute instance;
- creating a second set of rules in the number of rules for the file integrity monitor to detect changes in the files based on a file monitoring specification received from a user, wherein the second set of rules is created in response to a user selection to perform custom file integrity monitoring;
- dynamically managing one or more additional rules in the number of rules for the file integrity monitor to detect interactions with the files based on a context of the compute instance, wherein the one or more additional rules vary over time according to the context detected by a local security agent executing on the compute instance, and wherein the context includes an attempt to tamper with one or more protected files on the compute instance;
- updating the one or more additional rules based on one or more events detected on the compute instance indicative of a change in a security posture of the compute instance;
- monitoring data usage on the compute instance according to one or more rules of the number of rules including at least one of the first set of rules automatically created for the operating system, at least one of the second set of rules created in response to the user selection, and at least one of the one or more additional rules selected dynamically according to the context detected by the local security agent;
- and
- reporting one or more events impacting file integrity based on one or more rules of the number of rules.
5 more elements
A method comprising:
- instrumenting a compute instance with a data integrity monitor, the data integrity monitor configured with a number of rules to report events in response to interactions with data on the compute instance;
- creating a first set of rules in the number of rules for the data integrity monitor to detect changes in the data based on an operating system for the compute instance, wherein the first set of rules is created automatically based on a detection of the operating system for the compute instance;
- creating a second set of rules in the number of rules for the data integrity monitor to detect changes in the data based on a data monitoring specification received from a user, wherein the second set of rules is created in response to a user selection to perform custom file integrity monitoring;
- dynamically managing one or more additional rules in the number of rules for the data integrity monitor to detect interactions with the data based on a context of the compute instance, wherein the one or more additional rules vary over time according to the context detected by a local security agent executing on the compute instance;
- updating the one or more additional rules based on one or more events detected on the compute instance indicative of a change in a security posture of the compute instance;
- monitoring data usage on the compute instance according to one or more rules of the number of rules including at least one of the first set of rules automatically created for the operating system, at least one of the second set of rules created in response to the user selection, and at least one of the one or more additional rules selected dynamically according to the context detected by the local security agent;
- and
- reporting one or more events impacting file integrity based on one or more rules of the number of rules.
5 more elements
A system comprising:
- a file integrity monitor deployed on a compute instance, the file integrity monitor executing on a processor and configured to report file integrity impacting events in response to indications of interactions with data on the compute instance;
- a number of file integrity monitoring rules including a first set of rules by which the file integrity monitor detects indications of changes in files based on characteristics of an operating system for the compute instance and a second set of rules by which the file integrity monitor detects indications of changes in the data based on a data monitoring specification received from a user, wherein the first set of rules is created automatically based on a detection of the operating system for the compute instance and the second set of rules is created in response to a user selection to perform custom file integrity monitoring;
- and
- a rules engine, executing on a processor, that adapts the number of file integrity monitoring rules based on a context of the compute instance in order to dynamically adjust one or more additional rules in the number of file integrity monitoring rules based on additional information about the compute instance provided by the context, the rules engine further updating the one or more additional rules in the number of file integrity monitoring rules based on one or more events detected on the compute instance indicative of a change in security posture of the compute instance,
- wherein the file integrity monitor is further configured for monitoring data usage on the compute instance according to one or more rules of the number of rules including at least one of the first set of rules automatically created for the operating system, at least one of the second set of rules created in response to the user selection, and at least one of the one or more additional rules selected dynamically based on the additional information about the compute instance provided by the context, and for reporting one or more events impacting file integrity based on one or more rules of the number of rules.
2 more elements
Dependencies are inferred from the claim text.