Embedded system integrity monitoring enforcement architecture

A method for monitoring the integrity of a computer architecture, the method comprising the steps of:

• providing a registration component for receiving and compiling offline data into registration objects;
• providing a behavior, constraint and test data database for receiving the registration objects from the registration component and measuring the offline data against predetermined benchmarks to yield test results;
• providing a prioritization component configured to receive plural inputs from the behavior, constraint and test data database in parallel and prioritize an order for processing the test results;
• providing a reporter component for determining which test results, if any, should be escalated as a warning of anomalous behavior;
• providing an enforcement component for taking mitigative action with external components responsive to anomalous behavior reported in the test results;
• and
• providing plural runtime data providers intermediate the behavior, constraint and test database and the prioritization component and being configured to provide the benchmarks, wherein the runtime data providers are selected from the group consisting of a message/data parser component, a message/data relevancy component, a message/database and a check component notification;
• and taking mitigative action with one or more components responsive to the warning of anomalous behavior.

A method of monitoring the integrity of a computer architecture using a system embedded therein, the method comprising the steps of:

• providing a plurality of benchmarks relevant to operation of a computer;
• receiving offline data comprising multiple packets of data;
• compiling the offline data into registration objects using a registration component;
• measuring the offline data against the a plurality of respective benchmarks to using a behavior, constraint and test data database to yield test results;
• determining which test results should be escalated as a status indicating anomalous behavior;
• and taking mitigative action with one or more external components selected from a group consisting of network switches, policy management engines and security scanners, the one or more external components being responsive to the respective anomalous behavior, wherein the step of taking mitigative action comprises a step of discontinuing network traffic to a network switch and reporting the status to a graphical component for interpretation by a user.