公开(公告)号：US08732824B2

公开(公告)日：2014-05-20

申请号：US11656453

申请日：2007-01-23

申请人： William A. Arbaugh ,  Jeffrey D. Chung ,  Nick L. Petroni ,  Bryan Boot

发明人： William A. Arbaugh ,  Jeffrey D. Chung ,  Nick L. Petroni ,  Bryan Boot

IPC分类号： G06F11/00 ,  G06F12/14 ,  G06F12/16 ,  G08B23/00

CPC分类号： G06F21/57

摘要： Monitoring integrity of a running computer system is based on creating a Test Model which includes predicates descriptive of invariant properties of security relevant objects and their attributes in the monitored structure known-to-be “healthy”, acquiring memory image of a portion of the running monitored structure, decomposing the acquired memory image to retrieve representation of the security relevant objects of interest, by implementing the attributes of the Test Model, and verifying, by implementing the predicates, whether the invariant properties defined in the Test Model remain unchanged for the running host system. If a discrepancy is detected, a signal indicative of a detected discrepancy is transmitted to a management entity for analysis and formulating a course of action.

摘要翻译： 监视正在运行的计算机系统的完整性是基于创建一个测试模型，该测试模型包括描述安全相关对象的不变属性的谓词，以及在被称为“健康”的已监测结构中的属性，获取运行的一部分的内存映像 监测结构，通过实施测试模型的属性来分解所获取的存储器图像以检索安全相关对象的表示，并且通过实现测试模型来验证测试模型中定义的不变性质是否保持不变 主机系统。 如果检测到差异，则指示检测到的差异的信号被发送到管理实体以进行分析和制定行动过程。