Juniper Networks, Inc.

Networks Associates Technology, Inc.

Stephen Kiernan

Simon John Gerraty

Calvin Ko

Douglas Kilpatrick

In general, the invention is directed to techniques for verifying the integrity of a file system and individually verifying files contained therein based on the integrity of the file system. For example, a computer-based device is described in which a computer-readable storage medium stores a file system stored as an image file. The device comprises a virtual file system comprising a mount list entry that corresponds to the file system, wherein the file system is mounted on the virtual file system, and wherein the mount list entry comprises a first verified flag that indicates whether the file system is verified. A verified execution module determines whether the image file is corrupt, and a kernel module sets the first verified flag when the image file is not corrupt. An image verify module verifies the integrity of files stored by the file system by determining whether the file system is verified.

File integrity verification using a verified, image-based file system

A real-time sequence-based anomaly detection system is disclosed. In a preferred embodiment, the intrusion detection system is incorporated as part of a software wrapper. Event abstraction in the software wrapper enables the intrusion detection system to apply generically across various computing platforms. Real-time anomaly detection is enabled through the definition of a distance matrix that defines allowable separation distances between pairs of system calls. The distance matrix indirectly specifies known sequences of system calls and can be used to determine whether a sequence of system calls in an event window represents an anomaly. Anomalies that are detected are further analyzed through levenshtein distance calculations that also rely on the contents of the distance matrix.

Growing community of inventors

Herndon, VA, United States of America

Stephen Kiernan