Data security system

摘要

Various exemplary embodiments relate to a method of identifying unauthorized access to a data file on an unauthorized machine. The method includes: modifying the data file to include surreptitious code, the surreptitious code executing on a machine when the data file is opened or otherwise used by the machine; and receiving information transmitted by the surreptitious code, wherein the surreptitious code includes instructions for: gathering information about the executing machine, determining whether the executing machine is an unauthorized machine, and transmitting the information if the executing machine is an unauthorized machine. Various exemplary embodiments relate to a non-transitory machine-readable storage medium, the storage medium including instructions for: executing surreptitious code when the medium is accessed by a computing device; gathering information about the computing device; determining whether the computing device is an authorized machine; and transmitting the information if the computing device is an unauthorized machine.

主权项

1. A method, comprising:
identifying unauthorized access to a data file on a computerized machine: modifying the data file to include surreptitious code, the surreptitious code executing on the computerized machine when the data file is opened or otherwise used on the computerized machine; providing the modified data file to an authorized machine; and receiving information transmitted by the surreptitious code, wherein the surreptitious code comprises instructions for:
gathering information about the computerized machine,determining whether the computerized machine is an unauthorized machine,concealing or protecting copies or versions of the surreptitious code on the unauthorized machine, and surreptitiously transmitting the information if the computerized machine is an unauthorized machine, wherein the instructions for concealing or protecting copies or versions of the surreptitious code comprise at least one of: instructions for renaming files; instructions for avoiding operating system audits; instructions for using existing code already installed on the unauthorized machine to carry out some or all of the functions of the surreptitious code; and instructions for generating multiple mutually supporting programs such that the deletion of one program triggers an additional program that continues to perform the security functions of the surreptitious code.