Desktop security in peer-to-peer networks
View Patent ↗A peer-to-peer network is monitored for suspicious activity based on patterns of activity. When a particular pattern of suspicious activity is detected, an action associated with the particular pattern is taken. The activity monitored may include network traffic among peers and data sharing on a peer in the network. The action may be to log information about the suspicious activity and/or to send an alert about the suspicious activity.
1. A computerized method comprising:
monitoring a peer-to-peer network for suspicious activity based on patterns of activity; and
performing an action associated with a suspicious pattern of activity when the suspicious pattern of activity is detected in the peer-to-peer network, the suspicious pattern of activity defined by a set of rules for detecting at least one of Trojan horse code, viruses, a user browsing data across peers, unwanted user activity, and malicious code attempting to contact a home location;
wherein the peer-to-peer network permits peers to connect and operate substantially without a server by utilizing the server, at most, for providing addresses for the peers in the peer-to-peer network;
wherein the suspicious pattern of activity is defined in terms of a configuration of shared data on a peer, the configuration establishing a baseline of authorized shares and permissions in association with the shared data;
wherein monitoring a peer-to-peer network comprises evaluating a change with respect to the shared data on a peer in the peer-to-peer network, the change being made with respect to the baseline.
2. The computerized method of claim 1 , wherein monitoring a peer-to-peer network comprises:
evaluating network traffic among peers in the peer-to-peer network.
3. The computerized method of claim 1 , wherein a pattern of activity is defined in terms of a threshold value of network traffic in the peer-to-peer network.
4. The computerized method of claim 1 , wherein a pattern of activity is defined in terms of network traffic in the peer-to-peer network that uses a specific protocol.
5. The computerized method of claim 1 , wherein a pattern of activity is defined in terms of network traffic in the peer-to-peer network having a foreign address.
6. The computerized method of claim 1 , wherein the action comprises logging information about the suspicious pattern of activity.
7. The computerized method of claim 1 , wherein the action comprises sending an alert about the suspicious pattern of activity.
8. The computerized method of claim 1 , wherein the patterns of activity are local to a peer in the peer-to-peer network.
9. The computerized method of claim 1 , wherein the patterns of activity are global to the peer-to-peer network.
10. The computerized method of claim 1 wherein the set of rules specifies the patterns of activity as suspicious activity and specifies associated actions.
11. The computerized method of claim 10 further comprising:
refreshing the set of rules when the set of rules changes.
12. A non-transitory computer-readable medium having executable instructions to cause a processor to perform a method comprising:
monitoring a peer-to-peer network for suspicious activity based on patterns of activity; and
performing an action associated with a suspicious pattern of activity when the suspicious pattern of activity is detected in the peer-to-peer network, the suspicious pattern of activity defined by a set of rules for detecting at least one of Trojan horse code, viruses, a user browsing data across peers, unwanted user activity, and malicious code attempting to contact a home location;
wherein the peer-to-peer network permits peers to connect and operate substantially without a server by utilizing the server, at most, for providing addresses for the peers in the peer-to-peer network;
wherein the computer program product is operable such that the suspicious pattern of activity is defined in terms of a configuration of shared data on a peer, the configuration establishing a baseline of authorized shares and permissions in association with the shared data;
wherein the computer program product is operable such that monitoring a peer-to-peer network comprises evaluating a change with respect to the shared data on a peer in the peer-to-peer network, the change being made with respect to the baseline.
13. The non-transitory computer-readable medium of claim 12 , wherein the method further comprises:
evaluating network traffic among peers in the peer-to-peer network when monitoring the peer-to-peer network.
14. The non-transitory computer-readable medium of claim 12 , wherein a pattern of activity is defined in terms of a threshold value of network traffic in the peer-to-peer network.
15. The non-transitory computer-readable medium of claim 12 , wherein a pattern of activity is defined in terms of network traffic in the peer-to-peer network that uses a specific protocol.
16. The non-transitory computer-readable medium of claim 12 , wherein a pattern of activity is defined in terms of network traffic in the peer-to-peer network having a foreign address.
17. The non-transitory computer-readable medium of claim 12 , wherein the action comprises logging information about the suspicious pattern of activity.
18. The non-transitory computer-readable medium of claim 12 , wherein the action comprises sending an alert about the suspicious pattern of activity.
19. The non-transitory computer-readable medium of claim 12 , wherein the patterns of activity are local to a peer in the peer-to-peer network.
20. The non-transitory computer-readable medium of claim 12 , wherein the patterns of activity are global to the peer-to-peer network.
21. The non-transitory computer-readable medium of claim 12 , wherein the set of rules specifies the patterns of activity as suspicious activity and specifies associated actions.
22. The non-transitory computer-readable medium of claim 21 , wherein the method further comprises:
refreshing the set of rules when the set of rules changes.
23. A system comprising:
a processor coupled to a memory through a bus;
a network interface coupled to the processor through the bus and further operable to selectively couple to a peer-to-peer network; and
a peer-to-peer security process executed by the processor from the memory to cause the processor to monitor the peer-to-peer network for suspicious activity based on patterns of activity, and to perform an action associated with a suspicious pattern of activity when the suspicious pattern of activity is detected in the peer-to-peer network, the suspicious pattern of activity defined by a set of rules for detecting at least one of Trojan horse code, viruses, a user browsing data across peers, unwanted user activity, and malicious code attempting to contact a home location;
wherein the peer-to-peer network permits peers to connect and operate substantially without a server by utilizing the server, at most, for providing addresses for the peers in the peer-to-peer network;
wherein the system is operable such that the suspicious pattern of activity is defined in terms of a configuration of shared data on a peer, the configuration establishing a baseline of authorized shares and permissions in association with the shared data;
wherein the system is operable such that monitoring a peer-to-peer network comprises evaluating a change with respect to the shared data on a peer in the peer-to-peer network, the change being made with respect to the baseline.
24. The system of claim 23 , wherein peer-to-peer security process further causes the processor to evaluate network traffic between the peers in the peer-to-peer network when monitoring the peer-to-peer network.
25. The system of claim 23 , wherein the peer-to-peer security process further causes the processor to monitor the peer-to-peer network for a pattern of activity defined in terms of a threshold value of network traffic in the peer-to-peer network.
26. The system of claim 23 , wherein the peer-to-peer security process further causes the processor to monitor the peer-to-peer network for a pattern of activity defined in terms of network traffic in the peer-to-peer network that uses a specific protocol.
27. The system of claim 23 , wherein the peer-to-peer security process further causes the processor to monitor the peer-to-peer network for a pattern of activity defined in terms of network traffic having a foreign address.
28. The system of claim 23 , wherein the peer-to-peer security process further causes the processor to log information about the suspicious pattern of activity when performing the action associated with the suspicious pattern of activity.
29. The system of claim 23 , wherein the peer-to-peer security process further causes the processor to send an alert about the suspicious pattern of activity when performing the action associated with the suspicious pattern of activity.
30. The system of claim 23 , wherein the system is a peer in the peer-to-peer network and the patterns of activity are local to the system.
31. The system of claim 23 , wherein the system is a server in the peer-to-peer network and the patterns of activity are global to the peer-to-peer network.
32. The system of claim 31 , wherein the system is a border firewall.
33. The system of claim 31 , wherein the system is a domain name server.
34. The system of claim 31 , wherein the set of rules specifies the patterns of activity as suspicious activity and specifies associated actions.
35. The system of claim 34 , wherein the peer-to-peer security process further causes the processor to refresh the set of rules when the set of rules changes.
36. The computerized method of claim 1 , wherein a share configuration loop is executed to detect changes to shares and corresponding permissions, and an action is initiated as a function of a type of the changes.
37. The computerized method of claim 36 , wherein the share configuration loop is executed dynamically.
38. The computerized method of claim 36 , wherein the share configuration loop is executed on a schedule.
39. The computerized method of claim 36 , wherein the share configuration loop examines a current share configuration against a previously recorded shared configuration to detect the changes to the shares and the corresponding permissions.
40. The computerized method of claim 36 , wherein, if the change includes an attempt to un-share a file or directory, the action includes a log entry.
41. The computerized method of claim 1 , wherein the suspicious pattern of activity includes a number of failed attempts by a computer in accessing an internal peer that exceeds a predetermined number.
42. The computerized method of claim 1 , wherein the suspicious pattern of activity includes more than a pre-defined number of internal computers requesting resolution of a single external address within a preset period of time.
43. The computerized method of claim 36 , wherein the share configuration loop is executed in parallel with a network traffic loop that detects incoming or outgoing network traffic from a computer as exhibiting an activity pattern defined as suspicious by a rule.