Detecting rootkits over a storage area network
AssigneeCisco Technology, Inc.
InventorsFabio R. Maino, Dinesh G. Dutt, Samar Sharma, Arindam Paul
Life of this patent
Estimating the term…
Abstract
Embodiments of the invention improve the detection of malicious software applications, such as a rootkit, on hosts configured to access storage volumes over a storage area network (SAN). A rootkit detection program running on a switch may be configured to detect rootkits present on the storage volumes of the SAN. Because the switch may mount and access storage volumes independently from the (possibly comprised) hosts, the rootkit is not able to conceal itself from the rootkit detection program running on the switch.
Claims15
A storage area network (SAN) routing device configured to provide one or more host systems with access to one or more storage volumes present on a storage device, comprising:
- a processor;
- a storage networking interface configured to manage read and write requests made by the host systems to access the one or more storage volumes, and wherein the SAN routing device provides the one or more host systems with access to the storage volumes such that a mounted storage volume appears to a host system as a storage device physically present on the host system;
- and
- a memory that includes a program, wherein the program is configured to:
- mount, by the routing device, one of the storage volumes present on the storage device,
- retrieve a manifest specifying a list of files, wherein the list of files specifies a list of known rootkit signatures,
- generate a file signature for each of one or more files on the mounted storage volume host system, and
- compare each generated file signature with the list of known rootkit signatures to detect the presence of a rootkit active in a memory of one of the host systems.
A method, comprising:
- periodically mounting, from a storage area network (SAN) routing device configured to connect a host system to one or more storage volumes present on a storage device, wherein the SAN routing device is configured to manage read and write requests made by the host systems to access the one or more storage volumes and wherein the SAN routing device provides the host system with access to the storage volumes such that a mounted storage volume appears to the host system as a storage device physically present on the host system;
- identifying one or more files present on the mounted storage volume;
- retrieving a manifest specifying a list of files, wherein the list of files specifies a list of known rootkit signatures;
- generating a file signature for each of one or more files on the mounted storage volume host system;
- comparing each generated file signature with the list of known rootkit signatures to detect the presence of a rootkit active in a memory of one of the host systems;
- and
- upon detecting a presence of a rootkit in one of the identified files, adding an entry reflecting the presence of the rootkit active in the memory of the host system to a file log.
An apparatus, comprising
- a means for connecting one or more host systems to one or more storage volumes present on a storage device such that a mounted storage volume appears to a host system as a storage device physically present on the host system;
- a means to manage read and write requests made by the host systems to access the one or more storage volumes;
- a means for mounting, from the apparatus, one of the storage volumes present on the storage device;
- a file manifest identifying one or more files, wherein the list of files specifies a list of known rootkit signatures;
- a means for:
- mounting one of the storage volumes present on the storage device,
- retrieving the file manifest specifying the list of known rootkit signatures,
- generating a file signature for each of one or more files on the mounted storage volume host system, and
- comparing each generated file signature with the list of known rootkit signatures to detect the presence of a rootkit active in a memory of one of the host systems.
Dependencies are inferred from the claim text.