System and method to detect boot kit attacks

A method comprising:

• receiving, current boot data associated with a current boot procedure of a first external device, wherein the first external device is connected to an external network, and the current boot data includes at least an amount of network data sent and received by the first external device over the external network during the current boot procedure and an amount of time that each step of the current boot procedure takes to be performed;
• performing a hash function on the current boot data to produce a current hash value;
• comparing the current hash value with a previous hash value that was produced using data associated with a previous boot procedure of the first external device that has been identified as not being corrupted;
• and
• sending to the first external device a first instruction to use a previous boot procedure when the current hash value is different than the previous hash value.

A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to:

• receive, current boot data associated with a current boot procedure of a first external device, wherein the first external device is connected to an external network, and the current boot data includes at least an amount of network data sent and received by the first external device over the external network during the current boot procedure and an amount of time that each step of the current boot procedure takes to be performed;
• perform a hash function on the current boot data to produce a current hash value;
• compare the current hash value with a previous hash value that was produced using data associated with a previous boot procedure of the first external device that has been identified as not being corrupted;
• and
• send to the first external device a first instruction to use a previous boot procedure when the current hash value is different than the previous hash value.