System and method of facilitating the identification of a computer on a network
View Patent ↗A system and method for facilitating identification of an attacking computer in a network is provided. A user attempting to login to a network application may be presented with a screen prior to the login which lists preconditions of gaining access to the application. If a user concurs with the preconditions, a security module is downloaded to the user's computer and executed which gathers various configuration settings and transmits the gathered information to a predetermined destination. The security module may also attempt to place a call to a predetermined destination over a modem in the computer to cause registration of caller-ID data when answered at the predetermined destination. Once the security check is completed, login may proceed with the network application. Any data gathered by the security module may be stored for later recall and use to identify the computer in the event of an attack.
1. A computer program product comprising a computer readable storage memory having readable program code embodied in the computer readable storage medium, the computer program product includes at least one component to:
process a login to an application only after capturing a plurality of configuration data of a computer performing the login, wherein the login is received from a login page associated with a graphical user interface (GUI);
recall the plurality of configuration data from a memory; and match at least portions of the recalled plurality of configuration data to corresponding portions of subsequent captured configuration data of a suspect computer to establish whether the recalled plurality of configuration data and the subsequent captured configuration data are both derived from the computer, wherein when the matching occurs, the computer is verified as possibly attacking the network and, wherein the plurality of configuration data comprises at least:
(i) computer configuration information;
(ii) Ethernet information associated with one or more Ethernet adapters;
(iii) registry information; and
(iv) hardware configuration information.
2. The computer program product of claim 1 , wherein the GUI is a security GUI and includes precondition terms for granting access to the login page.
3. The computer program product of claim 2 , wherein the precondition terms include approval for running an executable model digitally signed by an application owner.
4. The computer program product of claim 1 , wherein the plurality of the configuration data further comprises:
software configuration information comprising a software component identification, a browser configuration, a software component version, a driver version, an application identification and directory structure; and
operating system product information and associated libraries.
5. The computer program product of claim 1 , wherein the plurality of configuration data further comprises Internet Protocol (IP) addresses associated with the one or more Ethernet Adapters.
6. The computer program product of claim 5 , wherein the IP addresses include addresses to routers and addresses that are within private IP ranges.
7. The computer program product of claim 5 , wherein the IP addresses include additional unique configuration regarding a network topology.
8. The computer program product of claim 1 , wherein the registry information includes SYSTEM subtrees.
9. The computer program product of claim 1 , further comprising configuring a security module that stores a cookie on a user's computer to record data and date of a security scrutiny process.
10. A computer comprising:
a CPU, a computer readable memory and a computer readable storage media;
program instructions to process a login to an application only after capturing a plurality of configuration data of a computer performing the login;
program instructions to recall the plurality of configuration data;
program instructions to match at least portions of the recalled plurality of configuration data to corresponding portions of subsequent captured configuration data of a suspect computer to establish whether the recalled plurality of configuration data and the subsequent captured configuration data are both derived from the computer, wherein when the matching occurs, the computer is verified as possibly attacking the network; and
program instructions to provide a security module, which stores cookies on a user's computing device, to the computer based on receiving an approval of at least one condition, which executes on the computer to gather and send the plurality of configuration data, the plurality of configuration data comprises:
(i) computer configuration information;
(ii) Ethernet information associated with one or more Ethernet adapters;
(iii) IP address information; and
(iv) registry information;
wherein the program instructions are stored on the computer readable storage media for execution by the CPU.
11. The computer of claim 10 , wherein the security model comprises initiating a subsequent security check to obtain subsequent configuration data used to match the subsequent captured configuration data with subsequent gathered configuration information data.
12. The computer of claim 10 , wherein the program instructions to process a login include receiving the login from a login page associated with a security GUI.
13. The computer of claim 12 , wherein the security GUI includes a hostage.exe that collects network, software, or hardware information.
14. The computer of claim 10 , wherein the registry information includes version information and manufacture identification (ID) information.
15. The computer of claim 10 , wherein the plurality of the configuration data further comprises:
hardware configuration information;
software configuration information comprising a software component identification, a browser configuration, a software component version, a driver version, an application identification and directory structure; and
operating system product information and associated libraries.