Security monitoring at operating system kernel level

A method comprising:

• determining, for each process of a plurality of processes executing on a computing device, at least one privilege for accessing one or more hardware interfaces;
• determining, by the computing device, that an unauthorized process is attempting to modify one or more privileges associated with one or more processes of the plurality of processes;
• determining a quantity of unauthorized attempts to modify the one or more privileges;
• based on determining that the unauthorized process does not have permission to modify the one or more privileges and based on the quantity of the unauthorized attempts, terminating, by the computing device, the unauthorized process;
• and
• sending, by the computing device and to a remote server, a message indicating one or more unauthorized attempts by the unauthorized process to modify the one or more privileges.

A method comprising:

• determining, by a computing device:
• a plurality of processes associated with a plurality of user devices comprising a first user device, and
• a plurality of cryptographic hash functions, wherein each cryptographic hash function of the plurality of cryptographic hash functions corresponds to a process of the plurality of processes;
• based on the first user device executing a first process of the plurality of processes, sending, by the computing device and to the first user device, a first cryptographic hash function of the plurality of cryptographic hash functions corresponding to the first process;
• causing the first user device to execute the first cryptographic hash function on the first process to authenticate and check data integrity of the first process;
• and
• causing, by the computing device, the first user device to terminate each process indicated in information, received from the first user device, as having made an unauthorized attempt to access a host interface that the process did not have a privilege to access.

A method comprising:

• determining, for each process of a plurality of processes executing on a computing device:
• a validity period specific to the process;
• and
• one or more privileges for accessing one or more host interfaces;
• based on a determination that a first process, of the plurality of processes, is attempting to access a host interface of the one or more host interfaces, determining whether the first process is privileged to access the host interface based on the one or more privileges determined for the first process;
• determining, based on a validation check performed after expiration of the determined validity period associated with the first process, whether the first process is valid;
• based on a determination that the first process is not privileged to access the host interface or that the first process is not valid, determining that the first process is not authorized to access the host interface;
• and
• storing information indicating unauthorized attempts, by one or more processes of the plurality of processes, to access the one or more host interfaces.