File integrity monitoring tools: Issues, challenges, and solutions

Abstract

Ensuring integrity of sensitive files in file systems is imperative to computer systems. The vast majority of attacks work through unapproved or unauthorized access to sensitive files to take secret data like secret keys, passwords, credit card numbers, and so on. After that, attackers generally conceal their traces by subverting critical files like system logs. File system integrity monitoring is a well-known way to deal with ensuring integrity of sensitive and critical files. The file system is at the heart of any computing system as it stores the data and executable programs. Malicious users or malwares might change the content of a sensitive data file or insert malicious payload in an executable. Hence, monitoring the integrity of the files in the file system is of utmost importance. Significant research work has been done on file integrity monitoring tools. This article presents the currently available tools for file integrity monitoring and their underlying approaches. K E Y W O R D S file integrity monitoring, malware, security, tools, virtualization 1 INTRODUCTION Every modern operating system is backed by a nonvolatile storage system which stores kernel and program executables and other data files including program logs, configurations, and user defined data. Integrity of these files is important for the seamless operation of a system or business. A malicious attacker can modify the content of a file to perform various malicious activities. For example, corrupting a database configuration could result in failure of a database server. Injecting malicious code in an executable could cause erratic behavior during execution. This kind of malicious activities has already been reported by many users. 1 Furthermore, current rapid progression of ransomwares 2 is compromising integrity of sensitive data in large scale. Many business owners, including large private/public organizations, have paid thousands of dollars as ransom. 3 A secured software solution can be useful for early detection of irregular file modification. File Integrity Monitoring (FIM) is an internal control or procedure that performs and demonstrates integrity of files related to the operating system and application software. It compares and verifies the current state and baseline of files. This examination technique regularly includes computing a known cryptographic checksum of the file's original baseline and contrasting that with the present condition of the file. There should be a check on other attributes such as file size, version, modified by, creation date, modified date, IO operations, and cache operations of file to maintain or observe integrity of file. Apart from this, we should also check credentials, privileges and security settings, hash values, and configuration values. Traditionally, file integrity tools (FITs) are used to detect unauthorized file operations in a system. FITs are some software that can monitor file access in a system and trigger appropriate warnings. Much research has been done on file monitoring tools, which di...

Real-Time Intrusion Detection of Insider Threats in Industrial Control System Workstations Through File Integrity Monitoring

“…These tools continuously monitor the file system for changes, including changes to file attributes, content, and timestamps. They can generate alerts when unauthorized or unexpected modifications occur [30], [26].…”

“…Current FITs work offline pattern which means these tools will monitor the files at scheduled times to check the integrity of the system. Delay in detection is the biggest issue because this will create an opportunity for the intruder to take advantage of the system [30].…”

“…One of the main challenges when building a FIM is realtime detection, which should have minimal performance overhead to ensure it can be used effectively in real production environments. High-performance overhead can cause system slowdowns, reduced productivity, and user frustration, which could lead to the tool being disabled or ignored [30]. Implementing a FIM in an ICS poses specific challenges due to the constraints of computing resources and the need for continuous system operation.…”

Analyzing Data Theft Ransomware Traffic Patterns Using BERT

“…Once captured, the data undergoes rigorous preprocessing to filter out background network noise, thereby accentuating the characteristics unique to ransomware traffic. This preprocessing includes techniques such as signature-based analysis to identify known ransomware patterns, file integrity monitoring for detecting unauthorized alterations, and entropy scanning to identify randomness in encrypted files [17,22,28,44]. The result is a comprehensive dataset that embodies a diverse array of ransomware activities, laying the groundwork for subsequent analysis using the BERT model.…”

Real-time Container Integrity Monitoring for Large-Scale Kubernetes Cluster

“…We refer readers to Ref. [20] for detail comparison of currently available tools for file integrity monitoring and their underlying approaches.…”