System and method for operating malicious marker detection software on management controller of protected system

Patent metadata

Field	Value
Publication number	US-9319426-B2
Application number	US-201313920746-A
Country	US
Kind code	B2
Filing date	Jun 18, 2013
Priority date	Jun 18, 2013
Publication date	Apr 19, 2016
Grant date	Apr 19, 2016

Abstract

An information handling system includes a processor and a management controller separate from the processor. The management controller is operable to store an anti-virus program and a malicious marker detection program in a memory of the management controller, and to execute the malicious marker detection program. The malicious marker detection program operates to detect a state of a device of the information handling system, determine that the information handling system is under attack from a malicious program in response to detecting the state of the device, and send an alert to a management system coupled to the information handling system, the alert indicating that the information handling system is under attack from the malicious program.

First claim

What is claimed is:

1. An information handling system, comprising:
a processor to provide a host processing environment; and
a management controller separate from the processor and on a common board with the processor, the management controller operable to:
store an anti-virus program and a malicious marker detection program in a memory of the management controller; and
execute the malicious marker detection program to:
detect a state of a device of the information handling system;
determine that the host processing environment is under attack from a malicious program in response to detecting the state of the device; and
send an alert to a management system coupled to the information handling system, the alert indicating that the host processing environment is under attack from the malicious program.

2. The information handling system of claim 1 , wherein in detecting the state of the device the malicious marker detection program is further executed to:
read a status register of the device.

3. The information handling system of claim 2 , wherein in determining that the host processing environment is under attack the malicious marker detection program is further executed to:
detect that the status register has been changed.

4. The information handling system of claim 1 , wherein in detecting the state of the device the malicious marker detection program is further executed to:
read a memory of the information handling system.

5. The information handling system of claim 1 , wherein in detecting the state of the device the malicious marker detection program is further executed to:
detect a network destination of network traffic on the information handling system.

6. The information handling system of claim 1 , wherein in detecting the state of the device the malicious marker detection program is further executed to:
detect a malicious packet in network traffic on the information handling system.

7. The information handling system of claim 1 , wherein:
the device comprises a network storage device; and
in detecting the state of the device the malicious marker detection program is further executed to read data from the storage device.

8. The information handling system of claim 1 , wherein the management controller is further operable to:
receive an update to the malicious marker detection program from the management system; and
store the update to the malicious marker detection program in the memory of the management controller.

9. The information handling system of claim 8 , wherein, prior to receiving the update to the malicious marker detection program, the management controller is further operable to:
determine that the malicious marker detection program is out of date.

10. The information handling system of claim 1 , wherein the malicious marker detection program is further executed to:
determine that the attack from the malicious program can be mitigated; and
mitigate the attack from the malicious program.

11. A method comprising:
storing an anti-virus program and a malicious marker detection program in a memory of a management controller on an information handling system; and
executing by the management controller the malicious marker detection program, wherein executing the malicious marker detection program comprises:
detecting a state of a device of the information handling system;
determining that a host processing environment instantiated on a processor of the information handling system is under attack from a malicious program in response to detecting the state of the device, wherein the management controller is on a common board with the processor; and
sending an alert to a management system coupled to the information handling system, the alert indicating that the host processing environment is under attack from the malicious program.

12. The method of claim 11 , wherein in detecting the state of the device the malicious marker detection program, executing the malicious marker detection program further comprises:
reading a status register of the device.

13. The method of claim 12 , wherein in determining that the host processing environment is under attack, executing the malicious marker detection program further comprises:
detecting that the status register has been changed.

14. The method of claim 11 , wherein in detecting the state of the device, executing the malicious marker detection program further comprises:
reading a memory of the information handling system.

15. The method of claim 11 , wherein:
the device comprises a network storage device; and
in detecting the state of the device, executing the malicious marker detection program further comprises reading data from the storage device.

16. The method of claim 11 , further comprising:
receiving by the management controller an update to the malicious marker detection program from the management system; and
storing the update to the malicious marker detection program in the memory of the management controller.

17. The method of claim 16 , further comprising:
determine that the malicious marker detection program is out of date, prior to receiving the update to the malicious marker detection program.

18. A non-transitory computer-readable medium including code for carrying out a method, the method comprising:
storing an anti-virus program and a malicious marker detection program in a memory of a management controller; and
executing the malicious marker detection program, wherein executing the malicious marker detection program comprises:
detecting a state of a device of an information handling system;
determining that a host processing environment instantiated on a processor of the information handling system is under attack from a malicious program in response to detecting the state of the device, wherein the management controller is on a common board with the processor; and

sending an alert to a management system coupled to the information handling system, the alert indicating that the host processing environment is under attack from the malicious program.

19. The computer-readable medium of claim 18 , wherein in detecting the state of the device the malicious marker detection program, executing the malicious marker detection program further comprises:
reading a status register of the device.

20. The computer-readable medium of claim 19 , wherein in determining that the host processing environment is under attack, executing the malicious marker detection program further comprises:
detecting that the status register has been changed.

Assignees

• Dell Products Lp

Inventors

• Webb Theodore S
• Wilson Jacqueline H
• Ramsey Jon R
• Khatri Mukund P

Classifications

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title