Systems, methods, and media for defending computing systems from attack

1. A system for defending a computing system from attack, comprising:

a memory; and

a hardware processor coupled to the memory and configured to execute a local host that is configured to:

maintain a round counter that tracks a round number;

determine whether the round counter is divisible by a diameter of a graph identifying each of a plurality of hosts including the local host;

in response to determining that the round counter is divisible by the diameter of the graph, determine a location in the graph for each of the plurality of hosts including the local host;

determine monitor hosts of the plurality of hosts that are monitoring the local host;

determine monitoree hosts of the plurality of hosts that are being monitored by the local host;

send a message to each of the monitor hosts identifying a value of the round counter;

forward a first set of heartbeat messages previously sent from-one or more of the monitoree hosts to the monitor hosts;

attempt to receive messages from the monitoree hosts;

determine whether any messages were not received from the monitoree hosts; and

in response to determining that one or more messages were not received from the monitoree hosts, generate an alert.

2. The system of claim 1 , wherein the directed graph is a DeBruijn graph.

3. The system of claim 1 , wherein the location in the graph for each of a plurality of hosts is determined using a pseudo-random function.

4. The system of claim 3 , wherein the location in the graph for each of a plurality of hosts is determined using the pseudo-random function based on a shared key, the round counter, and an identifier for each of the plurality of hosts.

5. The system of claim 1 , wherein the message sent to each of the monitor hosts identifying a value of the round counter is signed.

6. The system of claim 1 , wherein the hardware processor is configured to generate an alert in response to determining whether any received messages are invalid.

7. The system of claim 1 , wherein the hardware processor is configured to determine whether any heartbeat messages were received early.

8. A method for defending a computing system from attack, comprising:

maintaining a round counter that tracks a round number for a local host using a hardware processor;

determining whether the round counter is divisible by a diameter of a graph identifying each of a plurality of hosts including the local host;

in response to determining that the round counter is divisible by the diameter of the graph, determining a location in the graph for each of the plurality of hosts including the local host using the hardware processor;

determining monitor hosts of the plurality of hosts that are monitoring the local host using the hardware processor;

determining monitoree hosts of the plurality of hosts that are being monitored by the local host using the hardware processor;

sending a message to each of the monitor hosts identifying a value of the round counter using the hardware processor;

forwarding a first set of heartbeat messages from one or more of the monitoree hosts to the monitor hosts using the hardware processor;

attempting to receive messages from the monitoree hosts using the hardware processor;

determining whether any messages were not received from the monitoree hosts using the hardware processor; and

in response to determining that one or more messages were not received from the monitoree hosts, generating an alert using the hardware processor.

9. The method of claim 8 , wherein the directed graph is a DeBruijn graph.

10. The method of claim 8 , wherein the location in the graph for each of a plurality of hosts is determined using a pseudo-random function.

11. The method of claim 10 , wherein the location in the graph for each of a plurality of hosts is determined using the pseudo-random function based on a shared key, the round counter, and an identifier for each of the plurality of hosts.

12. The method of claim 8 , wherein the message sent to each of the monitor hosts identifying a value of the round counter is signed.

13. The method of claim 8 , further comprising generating an alert in response to determining whether any received messages are invalid.

14. The method of claim 8 , further comprising determining whether any heartbeat messages were received early.

15. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for defending a computing system from attack, the method comprising:

maintaining a round counter that tracks a round number for a local host;

determining whether the round counter is divisible by a diameter of a graph identifying each of a plurality of hosts including the local host;

in response to determining that the round counter is divisible by the diameter of the graph, determining a location in the graph for each of the plurality of hosts including the local host;

determining monitor hosts of the plurality of hosts that are monitoring the local host;

determining monitoree hosts of the plurality of hosts that are monitored by the local host;

sending a message to each of the monitor hosts identifying a value of the round counter;

forwarding a first set of heartbeat messages from one or more of the monitoree hosts to the monitor hosts;

attempting to receive messages from the monitoree hosts;

determining whether any messages were not received from the monitoree hosts; and

in response to determining that one or more messages were not received from the monitoree hosts, generating an alert.

16. The non-transitory computer-readable medium of claim 15 , wherein the directed graph is a DeBruijn graph.

17. The non-transitory computer-readable medium of claim 15 , wherein the location in the graph for each of a plurality of hosts is determined using a pseudo-random function.

18. The non-transitory computer-readable medium of claim 17 , wherein the location in the graph for each of a plurality of hosts is determined using the pseudo-random function based on a shared key, the round counter, and an identifier for each of the plurality of hosts.

19. The non-transitory computer-readable medium of claim 15 , wherein the message sent to each of the monitor hosts identifying a value of the round counter is signed.

20. The non-transitory computer-readable medium of claim 15 , wherein the method further comprises generating an alert in response to determining whether any received messages are invalid.