US 12,425,434 B1
System and process for providing network intrusion detection
John G. Aron, Westlake, OH (US)
Filed by John G. Aron, Westlake, OH (US)
Filed on Apr. 26, 2024, as Appl. No. 18/647,565.
Application 18/647,565 is a continuation of application No. 17/143,635, filed on Jan. 7, 2021, abandoned.
Claims priority of provisional application 62/958,975, filed on Jan. 9, 2020.
Int. Cl. H04L 9/40 (2022.01); G06F 16/14 (2019.01)
CPC H04L 63/1425 (2013.01) [G06F 16/152 (2019.01); H04L 63/1416 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A method providing recognition of normal versus abnormal system behavior for improved intrusion detection, the method comprising:
generating, from at least one operating system kernel module at ring 0, a first file hash analysis for at least one file on a client node;
transmitting the first file hash analysis to an intrusion detection server configured to analyze file hash analyses;
generating, from the at least one operating system kernel module at ring 0, a second file hash analysis for the at least one file;
transmitting the second file hash analysis to the intrusion detection server;
comparing the first file hash analysis with the second file hash analysis to determine if an intrusion has occurred,
wherein if the first file hash analysis and the second file hash analysis are identical, generating a third file hash analysis for the at least one file; and,
wherein if the first file hash analysis and the second file hash analysis are not identical, generating and transmitting a secure notification to at least one mobile device, wherein the at least one mobile device is linked to the at least one operating system kernel via a secure and authenticated connection protocol; and
responsive to a determination that an abnormal system behavior has occurred, causing at least one mitigation activity to be executed at the client node.