Method and system for real time system log integrity protection

A non-transitory computer readable storage medium storing a computer program product comprising programming code instructions for executing a method for managing integrity of system log file data when the program is executed on a computer, the method comprising:

• at system boot time, defining one or more log files;
• intercepting, using a hook in a kernel of an operating system write operations by a file system to the at least one log file;
• upon each interception of a write operation by the hook in the kernel of the operating system to a respective one of the log files:
• extracting from a record of the log file to be written to by the write operation, a context of the write operation, the context including a process that created the log file or an identifier of a user that created the log file record;
• and
• comparing the context extracted in a current interception with the context extracted in a previous interception and stored in an opening token in the log file and, when the context has changed from the previous interception to the current interception, writing additional information in a closing token in the log file before allowing the write operation of the log file record to be written, the additional information in the closing token advising of a change in the context of the log file of the current interception;
• reading in the respective log file the additional information in the closing token advising of a change in the context of the log file of a writing interception and reading at least one log file record preceding the additional information to determine when it was a malicious writing;
• and,
• creating an output pointing out the malicious writing operations in the log file.

A system for managing integrity of system log file data, the system comprising:

• a computer device, including:
• a first component for intercepting, using a hook in a kernel of an operating system, write operations of a file system on at least one log file, the first component being adapted, at each interception of the write operation by the hook in the kernel of the operating system to a respective one of the log files, to:
• extract from a record of the log file to be written to by the write operation, a context of the write operation, the context including a process that created the log file or an identifier of a user that created the log file record;
• and
• compare the context extracted in a current interception with the context extracted in a previous interception and stored in an opening token in the log file and, when the context has changed from the previous interception to the current interception, write additional information in a closing token in the log file before allowing the write operation of the log file record to be written, the additional information in the closing token advising of a change in the context of the log file of the current interception;
• and
• a second component for:
• reading in the respective log file the additional information in the closing token advising of a change in the context of the log file of a writing interception and reading at least one log file record preceding the additional information to determine when it was a malicious writing;
• and,
• creating an output pointing out the malicious writing operations in the log file.