Rootkit Detection in a Computer Network
AssigneeTriumfant, Inc.
InventorMitchell N. QUINN
Life of this patent
Estimating the term…
Abstract
Systems and methods are provided for detecting a rootkit by way of a call timing deviation anomaly in a computer. The rootkits may be embedded in the operating system (OS) kernel, an application or other system function. An object call duration baseline is established for durations of object calls (e.g., a system or application call) initiated by the computer, where each object call has an associated call-type and the timing baseline is established on an object call-type basis. Object call durations initiated by the computers are monitored. An object call duration anomaly is detected when the object call duration fails a call duration deviation measurement test, and an indication of the call duration anomaly is generated when detected.
Claims25
A method for detecting a rootkit in a computer, comprising:
- establishing an object call duration timing baseline for durations of object calls initiated by the computer, wherein each object call has an associated object call-type and the timing baseline is established on a on an object call-type basis;
- monitoring object call durations initiated by the computer;
- detecting an object call duration anomaly when the object call duration fails an object call duration deviation measurement test based on the associated object call-type and the timing baseline for a given object call-type;
- and
- generating an indication of the object call duration anomaly when detected.
An apparatus for detecting a rootkit in a computer t, comprising:
- a network interface configured to facilitate communication over a network;
- and
- a processor configured to:
- establish object call duration timing baselines for durations of object calls, wherein each object call has an associated object call-type;
- monitor object call durations;
- detect an object call duration anomaly when an object call duration fails an object call duration deviation measurement test based on the associated call-type and the timing baseline for a given object call-type;
- and
- generate an indication of the object call duration anomaly when detected.
One or more computer readable storage media storing instructions for detecting a rootkit in a computer, the instructions, when executed by a processor, cause the processor to:
- establish an object call duration timing baseline for durations of object calls initiated by the computer, wherein each object call has an associated object call-type and the timing baseline is established on a on an object call-type basis;
- monitor object call durations initiated by the computer;
- detect an object call duration anomaly when the object call duration fails an object call duration deviation measurement test based on the associated object call-type and the timing baseline for a given object call-type;
- and
- generate an indication of the object call duration anomaly when detected.
Dependencies are inferred from the claim text.