Granted Patent B1

US 7,000,250 · App. 09/916,606 · Granted Feb 14, 2006

Abstract

Claims (82)

1. A method for protecting a computer in an opened share mode, comprising:

(a) running a computer on a network in an opened share mode, wherein the opened share mode indicates a file structure parameter and a name parameter and applies only to a manually selected list of at least one of application programs and data;

(b) monitoring attempts to access the computer by applications utilizing the network, using the file structure and name parameter;

(c) determining whether the applications attempt to modify the computer; and

(d) executing a security event in response to any attempt to modify the computer;

wherein the opened share mode indicates a plurality of parameters that are randomly selected to prevent detection of a virtuality of the parameters;

wherein the computer is run in an actual opened share mode and a virtual opened share mode such that the at least one of application programs and data is accessible in the actual opened share mode, and attempted access to the at least one of application programs and data associated with the virtual opened shared mode prompts a security process;

wherein the security process includes temporarily logging off the network, recording in a record information on any attempt to modify the computer including time and source information, logging the computer back on the network in a mode other than the actual opened share mode, transmitting the information to a third party, determining whether a trend is found indicative of a coordinated attack, and sending an alert and logging a culpable computer off the network based on the determination.

2. The method as recited in claim 1 , wherein the opened share mode allows other computers on the network to access data stored on the computer.

3. The method as recited in claim 1 , wherein the virtual opened share mode indicates to other computers of an ability to write to the computer.

4. The method as recited in claim 1 , wherein the opened share mode applies to each of a plurality of networks of which the computer is a member.

5. The method as recited in claim 1 , wherein the computer is run on the network in a plurality of opened share modes.

6. The method as recited in claim 1 , wherein any attempt to modify the computer is utilized in a heuristic analysis for identifying a coordinated attack on multiple computers.

7. The method as recited in claim 1 , wherein attempts to modify the computer are tracked.

8. The method as recited in claim 1 , wherein it is determined whether the applications attempt to write to memory in the computer, and the security event is executed in response to any attempt to write to memory in the computer.

9. The method as recited in claim 1 , wherein it is determined whether the applications attempt to copy a virus to memory in the computer, and the security event is executed in response to any attempt to copy the virus to memory in the computer.

10. The method as recited in claim 1 , wherein the security event includes logging the computer off the network in response to any attempt to modify the computer.

11. The method as recited in claim 1 , wherein the security event includes terminating the application attempting to modify the computer.

12. The method as recited in claim 1 , wherein the security event includes deleting the application attempting to modify the computer.

13. The method as recited in claim 1 , wherein the security event includes an alert transmitted via the network.

14. The method as recited in claim 13 , wherein the alert includes information associated with the application attempting to modify the computer.

15. The method as recited in claim 1 , wherein the file structure includes a tree structure.

16. A computer program product, stored on a computer-readable medium, for protecting a computer in an opened share mode, comprising:

(a) computer code for running a computer on a network in an opened share mode, wherein the opened share mode indicates a file structure parameter and a name parameter and applies only to a manually selected list of at least one of application programs and data;

(b) computer code for monitoring attempts to access the computer by applications utilizing the network, using the file structure and name parameter;

(c) computer code for determining whether the applications attempt to modify the computer; and

(d) computer code for executing a security event in response to any attempt to modify the computer;

wherein the opened share mode indicates a plurality of parameters that are randomly selected to prevent detection of a virtuality of the parameters;

wherein the computer is run in an actual opened share mode and a virtual opened share mode such that the at least one of application programs and data is accessible in the actual opened share mode, and attempted access to the at least one of application programs and data associated with the virtual opened shared mode prompts a security process;

wherein the security process includes temporarily logging off the network, recording in a record information on any attempt to modify the computer including time and source information, logging the computer back on the network in a mode other than the actual opened share mode, transmitting the information to a third party, determining whether a trend is found indicative of a coordinated attack, and sending an alert and logging a culpable computer off the network based on the determination.

17. The computer program product as recited in claim 16 , wherein the network includes the Internet.

18. The computer program product as recited in claim 16 , wherein the opened share mode allows other computers on the network to access data stored on the computer.

19. The computer program product as recited in claim 16 , wherein the virtual opened share mode indicates to other computers of an ability to write to the computer.

20. The computer program product as recited in claim 16 , wherein the opened share mode applies to each of a plurality of networks of which the computer is a member.

21. The computer program product as recited in claim 16 , wherein the computer is run on the network in a plurality of opened share modes.

22. The computer program product as recited in claim 16 , wherein any attempt to modify the computer is utilized in a heuristic analysis for identifying a coordinated attack on multiple computers.

23. The computer program product as recited in claim 16 , wherein attempts to modify the computer are tracked.

24. The computer program product as recited in claim 16 , wherein it is determined whether the applications attempt to write to memory in the computer, and the security event is executed in response to any attempt to write to memory in the computer.

25. The computer program product as recited in claim 16 , wherein it is determined whether the applications attempt to copy a virus to memory in the computer, and the security event is executed in response to any attempt to copy the virus to memory in the computer.

26. The computer program product as recited in claim 16 , wherein the security event includes logging the computer off the network in response to any attempt to modify the computer.

27. The computer program product as recited in claim 16 , wherein the security event includes terminating the application attempting to modify the computer.

28. The computer program product as recited in claim 16 , wherein the security event includes deleting the application attempting to modify the computer.

29. The computer program product as recited in claim 16 , wherein the security event includes an alert transmitted via the network.

30. The computer program product as recited in claim 29 , wherein the alert includes information associated with the application attempting to modify the computer.

31. The computer program product as recited in claim 16 , wherein at least a portion of the computer code resides on a gateway.

32. The computer program product as recited in claim 31 , wherein the security event includes blocking access to the computer.

33. A system including logic stored on a computer-readable medium, for protecting a computer in an opened share mode, the logic comprising:

(a) logic for running a computer on a network in an opened share mode, wherein the opened share mode indicates a file structure parameter and a name parameter and applies only to a manually selected list of at least one of application programs and data;

(b) logic for monitoring attempts to access the computer by applications utilizing the network, using the file structure and name parameter;

(c) logic for determining whether the applications attempt to modify the computer; and

(d) logic for executing a security event in response to any attempt to modify the computer;

wherein the opened share mode indicates a plurality of parameters that are randomly selected to prevent detection of a virtuality of the parameters;

wherein the computer is run in an actual opened share mode and a virtual opened share mode such that the at least one of application programs and data is accessible in the actual opened share mode, and attempted access to the at least one of application programs and data associated with the virtual opened shared mode prompts a security process;

wherein the security process includes temporarily logging off the network, recording in a record information on any attempt to modify the computer including time and source information, logging the computer back on the network in a mode other than the actual opened share mode, transmitting the information to a third party, determining whether a trend is found indicative of a coordinated attack, and sending an alert and logging a culpable computer off the network based on the determination.

34. A method for protecting a computer in an opened share mode, comprising:

(a) running a computer on a network in a virtual opened share mode and an actual opened share mode, wherein the virtual opened share mode allows other computers on the network to access predetermined data and programs resident on the computer, and indicates to other computers of an ability to write to the computer, and the actual opened share mode indicates a file structure parameter and a name parameter that are capable of actually being accessed by the other computers, and applies only to a manually selected list of at least one of application programs and data;

(b) monitoring attempts to access the computer by applications utilizing the network, using, at least in part, the file structure and name parameter;

(c) determining whether the applications attempt to modify the computer;

(d) tracking the attempts of the applications to modify the computer;

(e) transmitting an alert via the network in response to any attempt to modify the computer, wherein the alert includes information associated with the applications attempting to modify the computer;

(f) logging the computer off the network in response to any attempt to modify the computer; and

(g) deleting any application attempting to modify the computer;

(h) wherein any attempt to modify the computer is utilized in a heuristic analysis for identifying a coordinated attack on multiple computers;

(i) wherein information on any attempt to modify the computer including time and source information is recorded in a record;

(j) wherein the computer is logged back on the network in a mode other than the actual opened share mode prior to performing the heuristic analysis for identifying the coordinated attack and at least one computer is logged off the network based on heuristic analysis;

(k) wherein (d)–(j) are carried out if it is determined that the applications attempt to modify the computer via the virtual opened share mode; and

access is permitted if it is determined that the applications attempt to modify the computer via the actual opened share mode;

wherein the parameters are randomly selected to prevent detection of a virtuality of the parameters.

35. A computer program product stored on a computer-readable medium, for protecting a computer in an opened share mode, comprising:

(a) computer code for running a computer on a network in a virtual opened share mode and an actual opened share mode, wherein the virtual opened share mode allows other computers on the network to access predetermined data and programs resident on the computer, and indicates to other computers of an ability to write to the computer, and the actual opened share mode indicates a file structure parameter and a name parameter that are capable of actually being accessed by the other computers, and applies only to a manually selected list of at least one of application programs and data;

(b) computer code for monitoring attempts to access the computer by applications utilizing the network, using, at least in part, the file structure and name parameter;

(c) computer code for determining whether the applications attempt to modify the computer;

(d) computer code for tracking the attempts of the applications to modify the computer;

(e) computer code for transmitting an alert via the network in response to any attempt to modify the computer, wherein the alert includes information associated with the applications attempting to modify the computer;

(f) computer code for logging the computer off the network in response to any attempt to modify the computer; and

(g) computer code for deleting any application attempting to modify the computer;

(h) wherein any attempt to modify the computer is utilized in a heuristic analysis for identifying a coordinated attack on multiple computers;

(i) wherein information on any attempt to modify the computer including time and source information is recorded in a record;

(j) wherein the computer is logged back on the network in a mode other than the actual opened share mode prior to performing the heuristic analysis for identifying the coordinated attack and at least one computer is logged off the network based on heuristic analysis;

(k) wherein (d)–(j) are carried out if it is determined that the applications attempt to modify the computer via the virtual opened share mode; and

access is permitted if it is determined that the applications attempt to modify the computer via the actual opened share mode;

wherein the parameters are randomly selected to prevent detection of a virtuality of the parameters.

Assignments (11)