# US 12,225,035 B2 · Systems, methods, and media for defending computing systems from attack > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,035 B2 - Document ID: US12225035B2 - Status: Granted - Kind: B2 - Application number: 18/378,002 - Filed: 2023-10-09 - Published: 2024-02-01 - Granted: 2025-02-11 - Earliest claimed: 2018-03-26 - Assignees: The Trustees of Columbia University in the City of New York - Applicants: The Trustees of Columbia University in the City of New York - Inventors: Yuan Jochen Kang; Salvatore Stolfo - Web page: https://patentgrep.com/patent/US12225035B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 7/582: {Pseudo-random number generators} - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - G06F 21/54: by adding security routines or objects to programs - G06F 21/554: {involving event detection and direct action} - G06F 21/602: {Providing cryptographic facilities or services} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Mechanisms for defending a computing system from attack are provided. The mechanisms include: maintaining a round counter that tracks a round number for a local host; determining a location in a graph for each of a plurality of hosts including the local host; determining monitor hosts of the plurality of hosts that are monitoring the local host; determining monitoree hosts of the plurality of hosts that are being monitored by the local host; sending a message to each of the monitor hosts identifying a value of the round counter; forwarding a first set of heartbeat messages from previous monitoree hosts to the monitor hosts; attempting to receive messages from the monitoree hosts; determining whether any messages were not received from the monitoree hosts; and in response to determining that one or more messages were not received from the monitoree hosts, generating an alert. ## Claims ### Claim 1 A system for defending a computing system from attack, comprising: a memory; and a hardware processor coupled to the memory and configured to execute a local host that is configured to: maintain a round counter that tracks a round number; determine whether the round counter is divisible by a diameter of a graph identifying each of a plurality of hosts including the local host; in response to determining that the round counter is divisible by the diameter of the graph, determine a location in the graph for each of the plurality of hosts including the local host; determine a monitor host of the plurality of hosts that is monitoring the local host; determine a monitoree host of the plurality of hosts that is monitored by the local host; send a message to the monitor host identifying a value of the round counter; forward a first set of heartbeat messages previously sent from the monitoree host to the monitor host; attempt to receive a message from the monitoree host; determine whether a message was not received from the monitoree host; and in response to determining that a message was not received from the monitoree host, generate an alert. ### Claim 2 (depends on 1) The system of claim 1, wherein the directed graph is a DeBruijn graph. ### Claim 3 (depends on 1) The system of claim 1, wherein the location in the graph for each of a plurality of hosts is determined using a pseudo-random function. ### Claim 4 (depends on 3) The system of claim 3, wherein the location in the graph for each of a plurality of hosts is determined using the pseudo-random function based on a shared key, the round counter, and an identifier for each of the plurality of hosts. ### Claim 5 (depends on 1) The system of claim 1, wherein the message sent to the monitor host identifying a value of the round counter is signed. ### Claim 6 (depends on 1) The system of claim 1, wherein the hardware processor is configured to generate an alert in response to determining whether any received messages are invalid. ### Claim 7 (depends on 1) The system of claim 1, wherein the hardware processor is configured to determine whether any heartbeat messages were received early. ### Claim 8 A method for defending a computing system from attack, comprising: maintaining a round counter that tracks a round number for a local host using a hardware processor; determining whether the round counter is divisible by a diameter of a graph identifying each of a plurality of hosts including the local host; in response to determining that the round counter is divisible by the diameter of the graph, determining a location in the graph for each of the plurality of hosts including the local host using the hardware processor; determining a monitor host of the plurality of hosts that is monitoring the local host using the hardware processor; determining a monitoree host of the plurality of hosts that is monitored by the local host using the hardware processor; sending a message to the monitor host identifying a value of the round counter using the hardware processor; forwarding a first set of heartbeat messages from the monitoree host to the monitor host using the hardware processor; attempting to receive a message from the monitoree host using the hardware processor; determining whether a message was not received from the monitoree host using the hardware processor; and in response to determining that a message was not received from the monitoree host, generating an alert using the hardware processor. ### Claim 9 (depends on 8) The method of claim 8, wherein the directed graph is a DeBruijn graph. ### Claim 10 (depends on 8) The method of claim 8, wherein the location in the graph for each of a plurality of hosts is determined using a pseudo-random function. ### Claim 11 (depends on 10) The method of claim 10, wherein the location in the graph for each of a plurality of hosts is determined using the pseudo-random function based on a shared key, the round counter, and an identifier for each of the plurality of hosts. ### Claim 12 (depends on 8) The method of claim 8, wherein the message sent to the monitor host identifying a value of the round counter is signed. ### Claim 13 (depends on 8) The method of claim 8, further comprising generating an alert in response to determining whether any received messages are invalid. ### Claim 14 (depends on 8) The method of claim 8, further comprising determining whether any heartbeat messages were received early. ### Claim 15 A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for defending a computing system from attack, the method comprising: maintaining a round counter that tracks a round number for a local host; determining whether the round counter is divisible by a diameter of a graph identifying each of a plurality of hosts including the local host; in response to determining that the round counter is divisible by the diameter of the graph, determining a location in the graph for each of the plurality of hosts including the local host; determining a monitor host of the plurality of hosts that is monitoring the local host; determining a monitoree host of the plurality of hosts that is monitored by the local host; sending a message to the monitor host identifying a value of the round counter; forwarding a first set of heartbeat messages from the monitoree host to the monitor host; attempting to receive a message from the monitoree host; determining whether a message was not received from the monitoree host; and in response to determining that a message was not received from the monitoree host, generating an alert. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the directed graph is a DeBruijn graph. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the location in the graph for each of a plurality of hosts is determined using a pseudo-random function. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the location in the graph for each of a plurality of hosts is determined using the pseudo-random function based on a shared key, the round counter, and an identifier for each of the plurality of hosts. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the message sent to the monitor host identifying a value of the round counter is signed. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the method further comprises generating an alert in response to determining whether any received messages are invalid.