Method and system for real time classification of events in computer integrity system

A system for real time classification of change events in a computing system comprising one or more client operational computers, the system comprising:

• (a11) a known secure computer free from inbound connections from other computer systems, the known secure computer having an operating system and software application programs, which are identical to the operating system and the software application programs running on the client operational computers, the known secure computer comprising:
• a processor;
• and
• a computer readable storage medium having computer readable instructions stored thereon for execution by the processor, forming a Known Secure Computing Module (KSCM), the KSCM comprising:
• (a11-i) an Update Acquisition Module visiting trusted hosts and checking for availability of software update for said one or more client operational computers;
• (a11-ii) a First Update Application Module performing the software update in advance of the client operational computers;
• and
• (a11-iii) a First Change Event Generation Module generating change events at the known secure computer in response to the software update;
• (b11) each client operational computer, comprising:
• a processor;
• and
• a computer readable storage medium having computer readable instructions stored for execution by the processor, forming a Deep Security Agent Module (DSAM) generating change events resulting from the software update performed on said each client operational computer;
• (c11) one or more security host computers, each security host computer comprising:
• a processor;
• and
• a computer readable storage medium having computer readable instructions stored for execution by the processor, forming a System Integrity Change Characterization Module (SICCM), comprising:
• (c11-i) a Processing Module comparing the change events in the first set of change events with respective change events generated at each said client operational computer and generating an alert for the change event, provided the change event in the first set of change events and the change event generated at the client operational computer differ.

In a system for real time classification of change events in a computing system comprising one or more client operational computers, each client operational computer performing software update and generating change events resulting from software update, a known secure computer, comprising:

• a processor;
• and
• a computer readable storage medium having computer readable instructions stored thereon for execution by the processor, forming a Known Secure Computing Module (KSCM), the KSCM comprising:
• (a20-i) an Update Acquisition Module visiting trusted hosts and checking for availability of software update for said one or more client operational computers;
• (a20-ii) a First Update Application Module performing the software update in advance of the client operational computers;
• (a20-iii) a First Change Event Generation Module generating change events at the known secure computer in response to the software update;
• and
• (a20-iv) a First Sender Module sending the change events generated by the First Change Event Determination Module for comparison with the change events generated at the client operational computers;
• the known secure computer being free from inbound connections from other computer systems, and having an operating system and software application programs, which are identical to the operating system and the software application programs running on the client operational computers.