International Business Machines Corporation

Valerio Graziani

Gaetano Ruggiero

Attilio Mattiocco

A method and system for managing integrity of system log file data. The system comprises a first component which, using a hook in a kernel of an operating system, allows interception of a write operation by a file system on at least one log file; then the first component detects a change in the security context in which the record is written in the log file. At each change detected, the first component adds information in the log file including the context information. The system further comprises a second component which reads the log file and, using the information added by the first component, detects if the change of context is due to a malicious writing operation in the log file for instance done by an unauthorized user or process.

Method and system for real time system log integrity protection

A log file is secured. One implementation involves maintaining a log file including one or more log entries in a storage device connected to a computer, and entering a new log entry by generating a new message authentication code based on a preceding log entry including a preceding message authentication code, and applying the message authentication code to the new log entry.

Growing community of inventors

Roma, Italy

Valerio Graziani