 |
|
|
|
|
|
 Title: |
US5572590:
Discrimination of malicious changes to digital information using multiple signatures
[ Derwent Title ]
|
| Country: |
US United States of America
|
| |
| Inventor: |
Chess, David M.; Mohegan Lake, NY
|
| Assignee: |
International Business Machines Corporation, Armonk, NY
other patents from INTERNATIONAL BUSINESS MACHINES CORPORATION (280070) (approx. 44,393)
News, Profiles, Stocks and More about this company
|
| Published / Filed: |
1996-11-05
/ 1994-04-12
|
| Application Number: |
US1994000226610
|
| IPC Code: |
Advanced:
G06F 1/00;
G06F 21/00;
G11B 20/00;
Core:
more...
IPC-7:
G11B 3/28;
H04K 1/00;
H04L 9/00;
|
| ECLA Code: |
G06F21/00N9C; G06F21/00N3V4T;
|
| U.S. Class: |
Current:
726/022;
713/188;
Original:
380/004;
380/049;
380/023;
380/024;
380/025;
395/186;
|
| Field of Search: |
380/004,3,5,23,24,25
395/186
371/40.1,51.1
|
| Priority Number: |
| 1994-04-12 |
US1994000226610 |
|
| Abstract: |
The present system and method uses information about digital information (objects) to determine whether or not changes to the objects were caused by a normal system operation or by a malicious program. The invention uses a reference separation algorithm to separate, at a reference time, one or more digital objects into a plurality of reference subsets of information that describe the object contents. A plurality of these reference subsets are then selected by a selection algorithm and information associated with each selected reference subset is stored. At some later time, called the test time, a test separation algorithm is used to separate the digital signatures of the object into a plurality of test subsets of information that describe the object contents at test time. A plurality of these test subsets are then selected by the test selection algorithm. A test information algorithm that is associated with each selected test subset then develops test subset information about the respective a test subset. The test subset information and the reference subset information is then compared to develop a set of differences. Rules are applied to the set of differences to determine whether the digital information at test time was changed (maliciously) from the digital information at reference time.
|
| Attorney, Agent or Firm: |
Percello, Louis J. ;
Drumheller, Ronald L. ;
|
| Primary / Asst. Examiners: |
Tarcza, Thomas H.; Sayadian, Hrayr A.
|
| Maintenance Status: |
E2 Expired Check current status
|
| INPADOC Legal Status: |
Show legal status actions
|
| Family: |
None
|
First Claim:
Show all 14 claims |
I claim:
1. A computer implemented method for determining whether changes to a set of digital information are innocent or malicious, comprising the steps of:
- using a reference separation algorithm, separating the set of digital information into a plurality of reference subsets of digital information, the step of separating the set of digital information into reference subsets being done at a reference time;
- using a reference selection algorithm, selecting a plurality of the reference subsets;
- using a reference information algorithm associated with each respective selected reference subset, deriving characteristic reference subset information from the respective selected reference subset;
- storing the derived characteristic reference subset information;
- using a test separation algorithm, separating the set of digital information into a plurality of test subsets of digital information, the step of separating the set of digital information into test subsets being done at a test time, the test time being later than the reference time;
- using a test selection algorithm, selecting a plurality of the test subsets, each selected test subset corresponding to a selected reference subset;
- using a test information algorithm associated with each respective selected test subset, deriving characteristic test subset information from the respective selected test subset;
- comparing the derived characteristic test subset information to the derived characteristic reference subset information to produce a set of differences; and
- analyzing the set of differences in accordance with a set of rules to determine whether the set of digital information at test time is changed from the set of digital information at reference time and if changed to determine whether the change is considered malicious or innocent, each of said rules specifying a particular combination of the selected test subsets, and specifying a state for the characteristic information of each selected test subset of each said particular combination relative to the characteristic information of each corresponding selected reference subset, and specifying for each said particular combination having its selected test subsets in said specified stake either a malicious conclusion or an innocent conclusion.
|
| Background / Summary: |
Show background / summary
|
| Drawing Descriptions: |
Show drawing descriptions
|
| Description: |
Show description
|
| Forward References: |
Show 69 U.S. patent(s) that reference this one
|
