[0001] The invention relates generally to computer equipment security, and more specifically to a method for detecting autonomous usage of a computer system connected to the Internet.
[0002] It is a problem in the field of computer systems to prevent unauthorized and/or autonomous collection of information regarding computer system usage and unauthorized dissemination of the collected information. Executable applications on the Internet may be autonomously downloaded to a subscriber's equipment connected to the Internet for autonomous usage in the background during operation of the equipment by the subscriber while the equipment is connected to the Internet. The Internet subscriber is often unaware of the installation on the equipment, the usage of the application to collect stored data, and the ability of the application to transmit the stored data via the equipment Internet connection to an unauthorized third party.
[0003] The autonomous applications may include peer-to-peer applications such as file sharing techniques, which once loaded by the subscriber must be consciously disabled or uninstalled by the subscriber to prevent autonomous use. The autonomous application may also use a distributed computing technique wherein the subscribers CPU and storage media is autonomously used with the resulting data being transmitted via the Internet connection to a central computer. Autonomous usage of a large number of computer CPUs speeds the processing and reduces the equipment required at the central computer. Another application which may be autonomously executed on a subscriber's equipment may collect information on the subscriber's personal use and forward the collected information to an entity such as an advertiser.
[0004] A first problem is that autonomous execution of applications uses the subscribers CPU processing capacity and storage media capacity without the subscriber's knowledge and often without the user's permission. A second problem arises when the autonomous use includes Internet usage for transferring information. The autonomous execution of these applications may result in substantial consumption of bandwidth by the subscriber. If the broadband high-speed service provider has a tiered billing system based on bandwidth consumption used by the subscriber, the autonomous use may lead to excessive service charges.
[0005] A known solution to the problem is firewall software to prevent the unauthorized download of the executable application to the subscriber's equipment. However, firewalls are vulnerable. Many peer-to-peer applications are designed to enable data to be passed through a firewall. Another problem with the usage of firewalls to prevent unauthorized downloading and later autonomous use of the subscriber's equipment is the inability of firewalls to correlate the subscriber's physical interaction with the Internet, the equipment central processing unit (CPU), and usage of the equipment storage media to guard against this vulnerability. Likewise, system-monitoring tools that may monitor such activities do not provide tools to notify the user of the unauthorized or autonomous activity or to prevent and/or terminate the unauthorized usage based on the observed equipment operation and subscriber physical interaction with the equipment.
[0006] For these reasons, a need exists for an unauthorized equipment usage detection application which detects the unauthorized download and/or autonomous usage and performs the steps necessary to prevent and/or terminate the unauthorized and/or autonomous usage.
[0007] The present method for detecting unauthorized computer system usage monitors the subscriber's activities while using the computer system, the system activities and the Internet activities. When an activity is detected with deviates from normal system usage and operation, the activity is unauthorized. The unauthorized activity may be recorded in an activity log or may be terminated by the computer system.
[0008] When the computer system is initialized, the subscriber may manually or automatically set parameters for determining when an activity is unauthorized. When manual initialization is selected, the subscriber sets parameters such as monitoring time interval, normal subscriber activities, and Internet upstream and downstream activity. The subscriber activities may be monitored usage of input devices such as keyboard, mouse or other input devices. Once parameters have been set by the subscriber, the system creates rules which correspond to the parameters and which may be used to compare monitored activities to the set parameters to detect unauthorized activity. During automatic initialization, the subscriber uses the computer system while the system monitors records normal activities. Using the recorded normal activity data, parameters are set and rules created for use detecting activities that deviate from the recorded normal activities.
[0009] When an unauthorized activity is detected, the activity may be recorded in an activity log for later use by the system or the subscriber. Alternatively, the rules may include responses to specific detect unauthorized activities such as terminating the activity or notifying the subscriber of the unauthorized use.
[0010]
[0011]
[0012]
[0013]
[0014]
[0015] The present method for detection of unauthorized computer system usage summarized above and defined by the enumerated claims may be better understood by referring to the following detailed description, which should be read in conjunction with the accompanying drawings. This detailed description of the preferred embodiment is not intended to limit the enumerated claims, but to serve as a particular example thereof. In addition, the phraseology and terminology employed herein is for the purpose of description, and not of limitation.
[0016] Executable applications on the Internet may be downloaded to a subscriber's equipment connected to the Internet for autonomous usage during operation of the equipment without the subscribers authorization, and often, without the subscribers knowledge. The subscriber is often unaware of the installation on the equipment and the possible usage of the application to collect information relating to the subscriber's physical interaction with the equipment. The subscriber is also unaware that the downloaded application may forward the collected information via the subscriber's Internet connection to an unknown and unauthorized party.
[0017] The autonomous applications may include peer-to-peer applications such as file sharing techniques, which once loaded by the subscriber must be consciously disabled or uninstalled by the subscriber to prevent autonomous use. When the peer-to-peer application is downloaded without the subscriber's authorization and/or knowledge, the subscriber is not in a position to consciously disable or uninstall the application. Another form of autonomous application uses a distributed computing technique wherein the subscriber's CPU and storage media is autonomously used with the resulting data being transmitted via the subscriber's Internet connection to a central computer. Autonomous usage of a large number of computer CPUs speeds the processing and reduces the equipment required at the central computer, at the expense of the unknowing subscriber. Another application which may be autonomously executed on a subscriber's equipment may collect information on the subscriber's personal use of the equipment or Internet activities and forward the collected information to an entity such as an advertiser.
[0018] The present method for detection of unauthorized computer system usage monitors the activity of the subscriber during computer system usage. Referring to the block diagram of
[0019] While the Internet provides the subscriber with the ability to access data from around the world, the Internet connection also provides a connection through which others may autonomously utilize the subscribers computer system, monitor the subscriber's activities to collect information and to forward the information collected to an unknown and/or unauthorized entity. The present method for detecting unauthorized computer system use provides a method to detect, log prevent and/or terminate the autonomous use based on the observed activities of the subscriber and the computer system CPU.
[0020] The subscriber's use of input devices to interact with the computer system may be monitored and used to detect unauthorized use. Subscriber activities via input devices such as a keyboard or mouse result in predictable CPU activity. The activities performed by the equipment's CPU may also be monitored. Correlation of the CPU activity, the subscriber's activities and the predictable CPU response to the subscriber activities, provides information that may be used for detecting CPU activity that is inconsistent with the subscriber's interaction with the equipment. Continuous inconsistent CPU activity may be used to detect unauthorized downloading of autonomous applications and/or autonomous usage of the subscriber's equipment. Further monitoring of the subscriber's usage and the Internet activity may reveal additional autonomous usage wherein the unauthorized application is not only utilizing the CPU capacity and the subscriber equipment storage media capacity, but is also using the subscriber's internet bandwidth capacity.
[0021] Set-Up Procedures—
[0022] A system embodying the present method for detection of unauthorized computer system usage may be initialized manually or automatically. If manual initialization is selected, the subscriber may set parameters for monitoring for unauthorized usage. Parameters may include time (T), click (C) representing subscriber input via keyboard strokes or mouse clicks, upbytes (U) representing data uploaded to the Internet and downbytes (D) representing data downloaded from the Internet. Time may act as an index for the activity log in which the unauthorized activities are recorded and may be collected at intervals defined by the subscriber during system setup. Allowing the subscriber to select the time intervals during which activities are monitored allows the subscriber to further customize the autonomous usage detection and unauthorized activity detection to meet the subscriber's needs.
[0023] The click (C) parameter may be designed to monitor the subscriber's physical interaction with the computer system and may include use of input devices such as keyboard use, mouse or other pointing device use, and gamepad or joystick use. System embodying a voice response system may monitor voice activity as well as, or in place of, manually operating input devices. System performance parameters may include activities such as processor use, RAM access, access of fixed storage devices such as disc drives for reading data from the storage device or writing data to the storage device and application file usage.
[0024] The Internet use parameters may include monitoring the output when data is sent upstream to the Internet (U), receipt of data from the Internet (D) and may also include the bandwidth consumption for the upstream and downstream Internet traffic. An activity log may be generated by accumulating and recording the activities for each of the parameters during a monitoring time interval.
[0025] Referring to the flow diagram of
[0026] In step
[0027] Referring to the flow diagram of
[0028] Operationally—
[0029] Once the parameters have been set and the corresponding rules developed, the system monitors the subscriber activities, system activities and Internet usage statistics. Referring to the flow diagram of
[0030]
[0031] To better understand the present method for detecting unauthorized and/or autonomous computer system use, an example of monitored activities and responses to the activities are described in the following paragraph. The system may be configured to monitor subscriber parameters, or clicks C, upstream (U) and downstream (D) activities at scheduled time intervals (T) and recorded the activity in an activity log. The data recorded in the activity log is compared with set constants for each parameter. After monitoring the system for a time interval, the activity log may include the number of bytes sent upstream (upbytes) U and the number of bytes received downstream (downbytes) D during the time interval T and the subscriber's activities, or clicks C, during the same time interval T. The rule used to detect unauthorized or autonomous use may be as follows:
[0032] IF [upbytes)>U] OR [(downbytes)>D] AND [clicks<C],
[0033] then, SUSPEND all upload and download activity on modem EXCEPT service provider network maintenance
[0034] Using the above rule, if the number upbytes recorded is greater than the predefined U or the number of downbytes is greater than the predefined value of D allowable during the time interval and the number of user interactions, clicks, are less than C, then a unauthorized or autonomous activity has been detected. In response to the detection, as indicated from the above rule, the computer system suspends all uploading and downloading activities except maintenance activities performed by the service provider. In other words, if there is Internet activity in the form of uploading or downloading data that is inconsistent with the activities performed by the subscriber, or the subscriber is not actively using the system, then the computer system should suspend the network activity except the network “keep alive” activity.
[0035] As to alternative embodiments, those skilled in the art will appreciate that the present method for detection of autonomous computer system usage may be implemented with alternative random variables. While the present method for detecting autonomous usage has been illustrated and described for use within a computer system, the detection software may be installed on an alternative device such as the modem. Likewise, while the parameters have been illustrated and described as time, upbytes, downbytes, and subscriber input activities, alternative parameters may be included for further monitoring system parameters or system activities corresponding to the input activities of the subscriber.
[0036] It is apparent that there has been described a method for detection of autonomous computer system usage that fully satisfies the objects, aims, and advantages set forth above. While the method for detection of autonomous computer system usage has been described in conjunction with specific embodiments thereof, it is evident that many alternatives, modifications, and/or variations can be devised by those skilled in the art in light of the foregoing description. Accordingly, this description is intended to embrace all such alternatives, modifications and variations as fall within the spirit and scope of the appended claims.