File Integrity Monitoring via Timestamp Counter Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for monitoring file integrity, such as relying solely on timestamps or using computationally intensive hash functions, are inadequate as they can be subverted by malicious applications or result in significant delays, respectively.
Innovation Solution
A system and method that intercepts timestamp change requests, maintains a counter of timestamp modifications in the operating system, and provides this information to a monitoring application for comparison, allowing for accurate detection of file modifications without relying solely on the file system's timestamp functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If timestamps are used to monitor file integrity, then the monitoring process is simple and fast, but the timestamps can be subverted by malicious applications
Solution Approach 1:
The patent introduces an intermediary mechanism (the monitoring application that intercepts timestamp change requests) between the file system and the user application. This intermediary tracks the actual changes to timestamps and provides accurate information about file modifications, preventing malicious applications from subverting the monitoring process by directly manipulating timestamps.
Solution Approach 2:
The system implements feedback by having the monitoring application continuously track timestamp changes and provide this information back to the user application. The monitoring application intercepts timestamp change requests, maintains records of these changes, and provides feedback about whether files have been modified, creating a closed-loop system that cannot be easily subverted.
2Reliability
If hash functions are used to monitor file integrity, then the monitoring is more reliable against subversion, but the computational burden is significant
Solution Approach 1:
Instead of using computationally intensive hash functions, the patent employs a simpler, cheaper mechanism using timestamps and counters. The monitoring application maintains a counter that increments whenever a timestamp changes, providing a lightweight and fast way to detect file modifications without the computational burden of hashing large files.
Solution Approach 2:
The patent extracts the essential information needed for integrity monitoring from the complex hash computation process. By taking out only the timestamp change information and maintaining a simple counter, the system achieves reliable monitoring without the computational intensity of full hash verification, separating the monitoring function from the heavy computational task.
Data Source
AI summary
A system, method and computer program product for monitoring file integrity that includes intercepting a function call by a user application to change a timestamp of a file; updating a record of a number of times the timestamp has been changed, wherein the record is maintained in operating system space; in response to a monitoring application requesting the record, providing, to the monitoring application, the record for comparison with information maintained by the monitoring application; and changing behavior of a user application if the record does not correspond to the information maintained by the monitoring application. This can be performed for multiple files, and each file can have a corresponding record. The records can be maintained in a database in operating system space. The monitoring application can maintain a database of a number of times the timestamps of the files have been modified. The record is, e.g., a counter.