System for identifying the presence of peer-to-peer network software applications

Abstract

A system and method for detecting peer-to-peer network software operating on a target computer. A target file is created, and placed in one or more folders on the target computer. A search is issued on a Peer-to-Peer network for the target file. Peer-to-peer software is detected to be operating on the target computer in accordance with results of the search.

What is claimed is: 
     
       1. A method for detecting whether peer-to-peer network file sharing software is operating on a target computer, the target computer connected to a computer network, comprising:
 a. creating, by a software program configured to access a file system of the target computer, a target file, and placing the target file that contains identifying data in one or more folders on the target computer, the identifying data uniquely identifying the target computer; 
 b. locatingreceiving, by the software program, a search string of a search for the target file on a Peer-to-Peerpeer-to-peer file sharing network, wherein the search is issued from a node of the peer-to-peer file sharing network to locate the target file independent of the target computer responding to athe search issued on the Peer-to-Peerpeer-to-peer network for the target file; and 
 c. detecting a determining, by the software program, that the target file is shared to one or more nodes of the peer-to-peer file sharing network as a result of the search; 
 determining, by the software program, that the peer-to-peer file sharing software is operating on the target computer in an event the target file is located on the Peer-to-Peer network in response to determining that the target file is in at least one folder of the target computer; and 
 blocking, by the software program, the target computer from communicating data traffic with the peer-to-peer file sharing network. 
 
     
     
       2. The method of  claim 1 , wherein the target file is placed in a plurality of folders on the target computer. 
     
     
       3. The method of  claim 1 , wherein the target file contains data that uniquely identifies the target computer. 
     
     
       4. The method of claim  3  1, wherein the identifying data is encrypted. 
     
     
       5. The method of claim  3  1, wherein the identifying data includes at least one of an IP address of the target computer, a name of the target computer, a name of a user of the target computer, an email address of the user of the target computer, or information entered by the network administrator or operator responsible for monitoring the target computer. 
     
     
       6. The method of  claim 3 , wherein the data contains a name of the target computer. 
     
     
       7. The method of  claim 3 , wherein the data contains a name of a user of the target computer. 
     
     
       8. The method of  claim 3 , wherein the data contains an email address of a user of the target computer. 
     
     
       9. The method of  claim 3 , wherein the data contains information entered by a network administrator or operator responsible for monitoring the target computer. 
     
     
       10. The method of  claim 1 , wherein the method is implemented at least in part using software that executes on the target computer. 
     
     
       11. The method of  claim 1 , wherein the method is implemented at least in part using software that executes on a computer different from the target computer. 
     
     
       12. The method of  claim 1 , further comprising: notifying at least one of a firewall, an intrusion detection system, a router, or an application, that the peer-to-peer file sharing software has been detected determined to be operating on the target computer, wherein the notification is performed based in accordance with an output of the detecting determining step. 
     
     
       13. A system for detecting whether peer-to-peer network file sharing software is operating on a target computer, the target computer connected to a computer network, comprising:
 a storage medium for storing instructions; and 
 a user input device for receiving user input; and 
 a processor unit operable to process the user input and to use the instructions to:
 create a target file; place the target file in one or more folders of the storage medium on the target computer prior to an administrator knowing whether or not the target computer is participating in peer-to-peer file sharing; 
 locatereceive a search string of a search for the target file on a Peer-to-Peerpeer-to-peer file sharing network, wherein the search is issued from a node of the peer-to-peer file sharing network to locate the target file independent of the target computer responding to athe search issued on a Peer-to-Peerpeer-to-peer network for the target file; and 
 determine that the target file is shared to one or more nodes of the peer-to-peer file sharing network as a result of the search;  
 detect whetherdetermine that the peer-to-peer file sharing software is operating on the target computer in an event the target file is located on the Peer-to-Peer networkin response to determining that the target file is in at least one folder of the target computer; and 
 block the target computer from communicating data traffic with the peer-to-peer file sharing network. 
 
 
     
     
       14. The system of  claim 13 , wherein the processor unit is operable to process the user input and to use the instructions to place the target file in a plurality of folders on the target computer. 
     
     
       15. The system of  claim 14 , wherein the target file contains data that uniquely identifies the target computer. 
     
     
       16. The system of claim  15  13, wherein the identifying data is encrypted. 
     
     
       17. The system of claim  15  13, wherein the identifying data includes at least one of an IP address of the target computer, a name of the target computer, a name of a user of the target computer, an email address of the user of the target computer, information entered by a network administrator, or an operator responsible for monitoring the target computer. 
     
     
       18. The system of  claim 15 , wherein the data contains a name of the target computer. 
     
     
       19. The system of  claim 15 , wherein the data contains a name of a user of the target computer. 
     
     
       20. The system of  claim 15 , wherein the data contains an email address of a user of the target computer. 
     
     
       21. The system of  claim 15 , wherein the data contains information entered by a network operator or administrator responsible for monitoring the target computer. 
     
     
       22. The system of  claim 13 , wherein the system is implemented using software that executes at least in part on the target computer. 
     
     
       23. The system of  claim 13 , wherein the system is implemented using software that executes at least in part on a computer different from the target computer. 
     
     
       24. The system of  claim 13 , wherein the processor unit automatically notifies at least one of a firewall, an intrusion detection system, a router, or an application, upon detection of peer-to-peer software. 
     
     
       25. A system for the detection of one or more Peer-to-Peer network software applications operating on a target computer, comprising:
 a. means for creating a target file, and placing the target file in one or more folders on the target computer;   b. means for locating the target file on a Peer-to-Peer network independent of the target computer responding to a search issued on a Peer-to-Peer network for the target file; and   c. means for detecting whether peer-to-peer software is operating on the target computer in an event the target file is located on the Peer-to-Peer network.   
     
     
       26. The system of  claim 25 , wherein the target file is placed in a plurality of folders on the target computer. 
     
     
       27. The system of  claim 25 , wherein the target file contains data that uniquely identifies the target computer. 
     
     
       28. A method executed by a monitoring agent on a peer-to-peer network for detecting peer-to-peer network participation of a first node, comprising:
 a. monitoring network data sent to the first node; and   b. issuing a search for a predetermined term on a peer-to-peer network while monitoring the network data sent to the first node;   c. detecting peer-to-peer participation of the first node in the peer-to-peer network if the monitoring identifies the the search being sent to the first node, the detecting being independent of the first node receiving the issued search.   
     
     
       29. The method of  claim 28 , further comprising notifying an administrator responsible for monitoring the node if peer-to-peer participation is detected. 
     
     
       30. The method of  claim 28 , further comprising automatically blocking data access to the first node if peer-to-peer participation is detected. 
     
     
       31. The method of  claim 28 , further comprising disabling peer-to-peer software associated with the first node if peer-to-peer participation is detected. 
     
     
       32. The method of  claim 28 , wherein the first node resides on a corporate computer network. 
     
     
       33. The method of  claim 28 , wherein the first node resides on a home computer network. 
     
     
       34. A system for detecting peer-to-peer network participation, comprising:
 a. means for monitoring network data sent to the first node;   b. means for issuing a search for a predetermined term on a peer-to-peer network while the means for monitoring the network data monitors the network data sent to the first node; and   c. means for detecting peer-to-peer participation of the first node in the peer-to-peer network if the means for monitoring identifies the the search being sent to the first node, the detecting means being independent of the first node receiving the issued search.   
     
     
       35. A method comprising:
 receiving, by a target computer, a target file to be placed in one or more folders on the target computer, the target file comprising identifying data, the identifying data uniquely identifying the target computer, wherein the target computer is configured to transmit and receive one or more messages over the computer network;   receiving, by target computer, a search string of a search on a peer-to-peer file sharing network for the target file;   determining, by the target computer, that the target file is on the peer-to-peer file sharing network in response to issuing the search, wherein the search is issued from a node of the peer-to-peer file sharing network to locate the target file independent of the target computer responding to the search issued on the peer-to-peer network for the target file;   determining, by the target computer, that peer-to-peer file sharing software is operating on the target computer in response to determining that the target file is in at least one folder of the target computer; and   blocking, by the target computer, the target computer from communicating data traffic with the one or more nodes of the peer-to-peer file sharing network in response to determining that the peer-to-peer file sharing software is on the target computer.   
     
     
       36. The method of claim 35, wherein the target file is placed in one or more folders located on the target computer. 
     
     
       37. The method of claim 35, wherein the identifying data includes at least one of an IP address of the target computer, a name of the target computer, or a name of a user of the target computer. 
     
     
       38. The method of claim 37, further comprising, removing the peer-to-peer software from the target computer. 
     
     
       39. A method for detecting peer-to-peer file sharing software operating on a target computer participating in a computer network, comprising:
 creating, by a software program of a computer, a target file containing data uniquely identifying the target computer in one or more folders on the target computer prior to an administrator knowing whether or not the target computer is participating in a peer-to-peer file sharing network;   issuing, by the software program, a search for the target file on the peer-to-peer file sharing network, wherein the search is issued to locate the target file independent of the target computer responding to the search issued on the peer-to-peer network for the target file;   determining, by the software program, that the peer-to-peer file sharing software is operating on the target computer based upon the search results received from the target computer; and   blocking, by the software program, the target computer from communicating data traffic in the peer-to-peer file sharing network.   
     
     
       40. The method of claim 39, wherein the target file is placed in a plurality of folders on the target computer. 
     
     
       41. A system for detecting peer-to-peer file sharing software operating on a target computer participating in a computer network, comprising:
 a storage medium for storing instructions; and   a user input device for receiving user input; and   a processor unit operable to process the user input and to use the instructions to:
 create a target file containing data uniquely identifying the target computer in one or more folders on the target computer prior to an administrator knowing whether or not the target computer is participating in a peer-to-peer file sharing network; 
 issue a search for the target file on the peer-to-peer file sharing network, wherein the search is issued to locate the target file independent of the target computer responding to the search issued on the peer-to-peer network for the target file; 
 determine that the peer-to-peer file sharing software is operating on the target computer based upon the search results received from the target computer; and 
 block the target computer from communicating data traffic in the peer-to-peer file sharing network. 
   
     
     
       42. The system of claim 41, wherein the processor unit is operable to process the user input and to use the instructions to place the target file in a plurality of folders on the target computer.